Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
910 results · Clear filters · Feed
-
Medium 6.4
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 6.4
Windows IP Translation Configuration Service Elevation of Privilege Vulnerability
Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.4
Windows Failover Cluster Elevation of Privilege Vulnerability
Use after free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.
-
Medium 4.7
Windows Management Services Information Disclosure Vulnerability
Use after free in Windows Management Services allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows System Events Broker Information Disclosure Vulnerability
Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally.
-
Medium 6.4
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
Medium 5.3
Windows DNS Denial of Service Vulnerability
Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.
-
Medium 5.5
Windows OLE Information Disclosure Vulnerability
Use after free in Windows OLE allows an authorized attacker to disclose information locally.
-
Medium 4.9
Role: DNS Server Denial of Service Vulnerability
Use after free in DNS Server allows an authorized attacker to deny service over a network.
-
Medium 6.4
Windows Filtering Platform (WFP) Elevation of Privilege Vulnerability
Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.
-
Medium 6.4
Windows PCI Bus Driver Elevation of Privilege Vulnerability
Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Use after free in DNS Server allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
HID class driver Information Disclosure Vulnerability
Use after free in HID class driver allows an authorized attacker to disclose information locally.
-
Medium 5.9
Windows Hyper-V Denial of Service Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.
-
Medium 6.8
Use after free in the MigTD virtio driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor…
-
Medium 6.8
Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivilege…
-
Medium 5.8
Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of ser…
-
Medium 5.3
FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding
FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof()…
-
Medium 5.1
This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously return…
-
Medium 5.8
Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstre…
-
Medium 5.8
Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multith…
-
Medium 4.3
Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sa…
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread…
-
Medium 5.9
Use After Free in µD3TN
Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure
-
Medium 4.8
Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress
The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, while the USB device st…
-
Medium 6.9
Use-after-free in INSTRUX array members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaini…
-
Medium 6.9
Use-after-free in INSTRUX structure members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member d…
-
Medium 6.7
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::we…
-
Medium 5.9
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect avai…
-
Medium 4.4
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium 6.7
In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege i…
-
Medium 4.4
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium 6.7
In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of priv…
-
Medium 6.7
In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege …
-
Medium 6.7
In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a m…
-
Medium 6.9
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…