Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
4,662 results · Clear filters · Feed
-
High 8.8
Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary…
-
High 8.8
Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code …
-
High 8.8
Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
-
High 8.8
Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code …
-
High 8.3
Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the render…
-
High 8.8
Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary co…
-
High 8.8
Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrar…
-
High 8.8
Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code …
-
High 7.8
SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends
SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via…
-
High 8.8
Use-after-free via dynamically allocated message queue retained by the CAN RX filter
The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferenc…
-
High 7.3
ThreadX Modules invokes trace-full callbacks after module unload
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap…
-
High 7.8
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL s…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local es…
-
High 8.4
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalati…
-
High 8.4
In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to…
-
High 8.1
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote …
-
High 8.4
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
High 8.4
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local e…
-
High 8.4
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to loca…
-
High 8.4
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local esca…
-
High 8.4
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead t…
-
High 8.4
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escal…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation…
-
High 7.3
VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free
A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated re…
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local es…
-
High 7.8
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privil…
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of …
-
High 8.8
Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next Finaliza…
-
High 7.8
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro …