Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

4,663 results · Clear filters · Feed

  • High 7.8
    CVE-2019-13315

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.207…

    Foxit Reader
  • High 7.8
    CVE-2019-13317

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…

    Foxit PhantomPDF
  • High 7.8
    CVE-2019-13319

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…

    Foxit Reader
  • High 7.8
    CVE-2019-13316

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…

    Foxit PhantomPDF
  • High 7.8
    CVE-2019-13326

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…

    Foxit Reader
  • High 7.8
    CVE-2019-13328

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…

    Foxit Reader
  • High 7.8
    CVE-2019-13327

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…

    Foxit Reader
  • High 7.8
    CVE-2019-13332

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25…

    Foxit Reader
  • High 7.5
    CVE-2019-16882

    Use after free in string-interner

    An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.

    string-interner crates.io
  • High 7.8
    CVE-2019-10996

    Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabiliti…

    Windows
  • High 8.8
    CVE-2019-5042

    An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 1…

    Talos Aspose.PDF for C++
  • High 7.0
    CVE-2019-3896

    A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacke…

    The Linux Foundation Kernel linux-azure linux Debian Ubuntu
  • High 7.8
    CVE-2019-6763

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • High 7.8
    CVE-2019-6762

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.…

    Foxit PhantomPDF
  • High 7.8
    CVE-2019-6761

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.…

    Foxit Reader
  • High 7.8
    CVE-2019-6757

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16…

    Foxit Reader
  • High 7.0
    CVE-2019-6768

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • High 7.8
    CVE-2019-6769

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • High 7.0
    CVE-2019-6767

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • High 8.1
    CVE-2019-5018

    An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially …

    sqlite3 sqlite Debian Alpine
  • High 7.8
    CVE-2019-0211 Exploited Public exploit EPSS 65%

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…

    Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.5
    CVE-2019-3817

    A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attack…

    libcomps libcomps
  • High 7.8
    CVE-2018-15982 Exploited · Ransomware Public exploit EPSS 90%

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successfu…

    flashplugin-nonfree Ubuntu
    KEV Feb 15, 2022
  • High 8.1
    CVE-2018-1000807

    PyOpenSSL Use-After-Free vulnerability

    Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack a…

    pyopenssl pyopenssl pyopenssl py-openssl Debian Ubuntu Alpine PyPI
  • High 8.8
    CVE-2017-15412

    Nokogiri gem, via libxml, is affected by DoS vulnerabilities

    Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    chromium-browser oxide-qt libxml2 libxml2 Browsers Debian Ubuntu RubyGems
  • High 7.8
    CVE-2018-10902

    It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2016-9079 Exploited Public exploit EPSS 87%

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
    KEV Jun 22, 2023
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • High 7.5
    CVE-2017-9790

    Use after free in Apache Mesos

    When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with …

    Apache Software Foundation Apache Mesos org.apache.mesos:mesos Maven
  • High 7.8
    CVE-2017-0261 Exploited Public exploit EPSS 78%

    Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

    Microsoft Microsoft Office
    KEV Mar 3, 2022
  • High 7.8
    CVE-2017-0263 Exploited Public exploit EPSS 10%

    The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

    Microsoft Microsoft Windows Windows
    KEV Feb 10, 2022
  • High 8.8
    CVE-2016-7892 Exploited EPSS 19%

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnera…

    KEV Mar 25, 2022
  • High 7.0
    CVE-2015-8963

    Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2016-5131

    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

    chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine
  • High 8.8
    CVE-2016-0984 Exploited Public exploit EPSS 55%

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High 7.0
    CVE-2015-6564

    Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-O…

    openssh openssh Debian Ubuntu
  • High 7.8
    CVE-2015-5122 Exploited Public exploit EPSS 87%

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5123 Exploited EPSS 19%

    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 1…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5119 Exploited Public exploit EPSS 99%

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022