Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
4,651 results · Clear filters · Feed
-
High 7.0
Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 7.5
Remote Desktop Gateway Service Elevation of Privilege Vulnerability
Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.0
Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
Use after free in Windows Function Discovery SSDP Provider allows an unauthorized attacker to execute code over an adjacent network.
-
High 7.8
Windows Message Queuing Elevation of Privilege Vulnerability
Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Message Queuing Elevation of Privilege Vulnerability
Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Link Layer Topology Discovery Protocol Elevation of Privilege Vulnerability
Use after free in Windows Link Layer Topology Discovery Protocol allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.
-
High 7.5
Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability
Use after free in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network.
-
High 7.5
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
Use after free in Windows Function Discovery Resource Publication allows an unauthorized attacker to execute code over an adjacent network.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows MIDI Service Module Elevation of Privileges Vulnerability
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows MIDI Service Module Elevation of Privileges Vulnerability
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Management Instrumentation Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Network Connection Broker Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
-
High 7.0
Winlogon Elevation of Privilege Vulnerability
Use after free in Winlogon allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows iSCSI Remote Code Execution Vulnerability
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authent…