Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
4,663 results · Clear filters · Feed
-
High 7.0
Windows TCP/IP Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Print Spooler Components Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
-
High 7.1
Windows NDIS Elevation of Privilege Vulnerability
Use after free in Windows NDIS allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows USB Video Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Push Notifications Elevation of Privilege Vulnerability
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Device Association Broker Service Elevation of Privilege Vulnerability
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Microsoft COM for Windows Elevation of Privilege Vulnerability
Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
-
High 7.0
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
-
High 7.1
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Push Notifications Elevation of Privilege Vulnerability
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows USB Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Use after free in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Push Notifications Elevation of Privilege Vulnerability
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows VHD miniport driver Elevation of Privilege Vulnerability
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Active Directory Domain Services Remote Code Execution Vulnerability
Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Server Elevation of Privilege Vulnerability
Use after free in Windows Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Security Center Elevation of Privilege Vulnerability
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.1
IP Helper Remote Code Execution Vulnerability
Use after free in IP Helper allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
High 7.8
Graphic Fonts Elevation of Privilege Vulnerability
Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows File History Service Elevation of Privilege Vulnerability
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Modern Execution Server Elevation of Privilege Vulnerability
Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Deployment Services Remote Code Execution Vulnerability
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
-
High 7.0
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.
-
High 7.0
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows File History Service Elevation of Privilege Vulnerability
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.