Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
4,663 results · Clear filters · Feed
-
High 7.8
A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system r…
-
High 7.0
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was c…
-
High 8.1CVE-2020-6819 Exploited
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…
KEV Nov 3, 2021 -
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29…
-
High 7.5
libslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
-
High 7.8CVE-2020-1712 Public exploit
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are…
-
High 7.8CVE-2020-8881 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.5
wicked: Use-after-free when receiving invalid DHCP6 client options
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 w…
-
High 7.5
wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 w…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8CVE-2020-8856 EPSS 20%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.…
-
High 7.8CVE-2020-8845 EPSS 19%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.8CVE-2020-8846 EPSS 20%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.5
GPGME Go wrapper contains Use After Free
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 8.8
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A…
-
High 8.0
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader versio…
-
High 8.8
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A…
-
High 8.8
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, versi…
-
High 7.1
Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets may take over the code execution of the JDHCPD process.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may remotely take over the code e…
-
High 7.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…
KEV Jun 27, 2022 -
High 7.8CVE-2019-8526 Exploited
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An a…
KEV Apr 17, 2023 -
High 8.8
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…
KEV May 23, 2022 -
High 8.8
Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap c…
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.…
-
High 7.5
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …
-
High 7.8
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…
KEV Nov 3, 2021 -
High 7.5
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially craf…
-
High 7.5
An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…