Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
914 results · Clear filters · Feed
-
Medium 6.5
IBM MQ Operator denial of service
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel proces…
-
Medium 5.7
The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Seq…
-
Medium 6.5
ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled user…
-
Medium 5.5
nfsd: fix management of listener transports
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previousl…
-
Medium 6.7
Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Use After Free in DSP Service
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
-
Medium 6.6
Use After Free in Data Network Stack & Connectivity
Memory corruption while processing IOCTL calls to add route entry in the HW.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while invoking IOCTL map buffer request from userspace.
-
Medium —
rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`
When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to `CString::drop`'s behavior)…
-
Medium 6.5
Use-after-free triggered by XSLTProcessor
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and …
-
Medium —
pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints
Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference…
-
Medium 5.5
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the …
-
Medium 4.3
Zoom Workplace Apps and SDKs - Divide By Zero
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
-
Medium 4.3
Zoom Workplace Apps and SDKs - Use After Free
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
-
Medium 6.4
Grub2: command/gpg: use-after-free due to hooks not being removed on module unload
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to …
-
Medium 5.3
Use After Free in Exiv2
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are **not** affected…
-
Medium 4.2
heap-use-after-free in function str_to_reg in vim/vim
Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex c…
-
Medium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may caus…
-
Medium 6.3
Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap co…
-
Medium 5.4
Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corr…
-
Medium 6.3
rust openssl ssl::select_next_proto use after free
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where …
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
-
Medium 5.5
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been fre…
-
Medium 4.4
UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause serv…
-
Medium 5.3
Use-after-free when breaking lines in text
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 12…
-
Medium 4.0
Compartment mismatch when parsing JavaScript JSON module
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
-
Medium 4.4
Communication_dsoftbus has an UAF vulnerability
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while processing frame command IOCTL calls.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
-
Medium 5.5
Acrobat Reader | Use After Free (CWE-416)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to …
-
Medium 5.1
GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gs…
-
Medium 6.7
Use After Free in Video
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
-
Medium 4.4
Use after free vulnerability in browser.c
There was discovered a use after free bug in browser.c in the es_browser_get_variant function
-
Medium 6.8
Use After Free in WLAN
A race condition exists in a driver potentially leading to a use-after-free condition.
-
Medium 6.5
In bta_dm_remove_sec_dev_entry of bta_dm_act.cc, there is a possible out of bounds read due to a use after free. This c…
-
Medium 5.9
Use After Free in gpac/gpac
A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash.
-
Medium 5.5
Kernel: cyttsp4_core: use-after-free in cyttsp4_watchdog_work()
A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, ca…