Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

145 results · Clear filters · Feed

  • Low 3.3
    CVE-2022-24368

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…

    Foxit PDF Reader
  • Low 3.3
    CVE-2022-24061

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM V…

    Sante DICOM Viewer Pro
  • Low 3.3
    CVE-2021-45063

    Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability

    Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An atta…

    Adobe Acrobat Reader
  • Low 3.3
    CVE-2021-45051

    Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…

    Adobe Bridge
  • Low 3.3
    CVE-2021-34886

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …

    Bentley View
  • Low 3.3
    CVE-2021-34884

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …

    Bentley View
  • Low 3.3
    CVE-2021-45059

    Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…

    Adobe InDesign
  • Low 3.3
    CVE-2021-45054

    Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…

    Adobe InCopy
  • Low 3.3
    CVE-2021-40730

    Adobe Acrobat Reader DC JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected insta…

    Adobe Acrobat Reader
  • Low 3.3
    CVE-2021-36008

    Adobe Illustrator PDF File Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the …

    Adobe Illustrator
  • Low 3.3
    CVE-2021-28593

    Adobe Illustrator PostScript Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Illustrator version 25.2.3 (and earlier) is affected by a Use After Free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose potential sensitive information in the context of the…

    Adobe Illustrator
  • Low 3.3
    CVE-2021-21061

    Acrobat Pro DC Use-After-Free Vulnerability Could Lead to Information Disclosure

    Acrobat Pro DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use-after-free vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage t…

    Adobe Acrobat Reader
  • Low 3.3
    CVE-2020-24438

    Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure

    Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interact…

    Adobe Acrobat Reader
  • Low 3.3
    CVE-2020-15637

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…

    Foxit PhantomPDF
  • Low 3.5
    CVE-2020-4031

    Use-After-Free in gdi_SelectObject in FreeRDP

    In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.3
    CVE-2019-17143

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…

    Foxit PhantomPDF
  • Low 3.3
    CVE-2019-6773

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6771

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6758

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6772

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6770

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6766

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6756

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Phant…

    Foxit PhantomPDF
  • Low 3.3
    CVE-2019-3885

    A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive …

    ClusterLabs pacemaker pacemaker pacemaker Debian Ubuntu
  • Low 3.3
    CVE-2016-8623

    A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…

    The curl Project curl curl curl Debian Ubuntu Alpine