Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
914 results · Clear filters · Feed
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5…
-
Medium 4.6
A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOC…
-
Medium 5.3
ckolivas lrzip stream.c lzma_decompress_buf use after free
A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be…
-
Medium 5.5
Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerab…
-
Medium 6.5
UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 4.0
Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect ava…
-
Medium 5.3
mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has…
-
Medium 6.3
ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocomm_ble) layer. The issue can be triggered by a re…
-
Medium 6.7
In imgsys, there is a possible escalation of privilege due to use after free. This could lead to local escalation of pr…
-
Medium 6.3
quickjs-ng quickjs Atomics Ops quickjs.c use after free
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now pu…
-
Medium 5.3
Open Asset Import Library Assimp LWOMaterial.cpp FindUVChannels use after free
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter::FindUVChannels of the file /src/assimp/code/AssetLib/LWO/LWOMaterial.cpp. Such manipulation leads t…
-
Medium 6.5
Junos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crash
A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS). When telemetry collectors are frequently su…
-
Medium 6.8
FreeRDP has a heap-use-after-free in irp_thread_func
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.
-
Medium 6.8
FreeRDP has a heap-use-after-free in create_irp_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability…
-
Medium 6.9
FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl->primary (SD…
-
Medium 6.5
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
-
Medium 6.8
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer when an oversized descriptor is requested but continues to use the stal…
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while accessing a synchronization object during concurrent operations.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while performing sensor register read operations.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while handling buffer mapping operations in the cryptographic driver.
-
Medium 6.7
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege i…
-
Medium 6.7
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege i…
-
Medium 6.7
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege i…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privi…
-
Medium 5.3
Apache NuttX RTOS: fs/vfs/fs_rename: use after free
Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the…
-
Medium 6.9
NanoMQ has Use-After-Free of malformed bridging message
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). The vulnerability is trigge…
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 an…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.2 an…
-
Medium 6.1
Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially pe…
-
Medium 5.3
ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is n…
-
Medium 6.7
In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to loc…
-
Medium 6.7
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containin…
-
Medium 6.7
An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF…
-
Medium 5.9
c-ares has a Use After Free vulnerability when connection is cleaned up after error
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
-
Medium 6.7
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect avai…
-
Medium 4.9
ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Cl…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…