Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
914 results · Clear filters · Feed
-
Medium 5.5
Use after free of view cache in Foxit PDF Editor/Reader
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object …
-
Medium 4.8
Use after free when parsing EDNS options in Lua
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been…
-
Medium 6.5
Multiple implicit reads in parallel can result in a crash or denial of service
Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: through 1.31 smartLink HW-PN: before 1.02.
-
Medium 5.5
EVerest: ISO15118 session_setup use-after-free can crash EVSE process
EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remote…
-
Medium 5.3
EVerest has use-after-free in auth timeout timer via race condition
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RFID/RemoteStart/OCPP authorization events (or delayed authorization response). Version 2026.2.0 conta…
-
Medium 4.2
EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free possible. This is triggered by EVCCID update (EV/ISO15118) and OCPP session/authorization events. Versi…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macO…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, ma…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7…
-
Medium 6.2CVE-2026-20637 Public exploit
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, ma…
-
Medium 6.4
Use After Free in No-Chicken Echo-Mate
Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329.
-
Medium 6.2
XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file
-
Medium 6.9
samtools mpileup has use-after-free leading to an invalid read
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned against a known reference. On each output line it writes the reference position, optionally the referen…
-
Medium 5.3
Libsoup: libsoup: denial of service via use-after-free in http/2 server
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentica…
-
Medium 5.3
PX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race Condition
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The issue is caused by a race condition between the MAVLink receiver thread (which handles shell creation/…
-
Medium 5.3
quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes use after free. The attack requires local access. The exploit has been published and may be used. Pat…
-
Medium 5.3
Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit reques…
-
Medium 5.9
Envoy HTTP: filter chain execution on reset streams causing UAF crash
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free"…
-
Medium 4.0
ImageMagick has a heap use-after-free in the MSL encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does…
-
Medium 5.3
ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by c…
-
Medium 5.3
NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is …
-
Medium 6.7
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead t…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 4.4
In display, there is a possible system crash due to use after free. This could lead to local denial of service if a mal…
-
Medium 4.4
In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a mali…
-
Medium 4.4
In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium —
Hive has Double-free and Use After Free Vulnerabilities
`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free. Additionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with…
-
Medium 5.5
FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implemen…
-
Medium 5.5
FreeRDP has heap-use-after-free in rail_window_free
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation…
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_clipboard_format_equal
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees…
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts …
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `surface->data`…
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_rail_server_local_move_size
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table…
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime prote…
-
Medium 5.5
FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the…
-
Medium 5.4
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
-
Medium 5.3
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the …
-
Medium 4.7
Use-after-free in Cloud Workloads
Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.
-
Medium 5.1
PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, w…