Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
914 results · Clear filters · Feed
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while processing IOCTL calls to unmap the buffers.
-
Medium 6.7
Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps.
-
Medium 6.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…
-
Medium 5.9
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
Medium 5.9
This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6…
-
Medium 5.3
Pyo3: risk of use-after-free in `borrowed` reads from python weak references
A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references.
-
Medium 6.4
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
Medium 4.4
AccessTokenManager has an use after free vulnerability
in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed apps through use after free.
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
-
Medium 6.7
Use After Free in Automotive Multimedia
Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
-
Medium 5.7
Object deserialization in Reverb leading to RCE
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and …
-
Medium 5.6
MicroPython objarray.c use after free
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complex…
-
Medium 5.5
Premiere Pro | Use After Free (CWE-416)
Premiere Pro versions 24.5, 23.6.8 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requi…
-
Medium 6.5
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 6.5
When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a …
-
Medium 5.5
ZDI-CAN-24186: Adobe Acrobat Reader DC Doc Object Use-After-Free Information Disclosure Vulnerability
Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations su…
-
Medium 5.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 4.5
Vim heap-use-after-free in src/arglist.c:207
The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including …
-
Medium 4.2
Vim < v9.1.0648 has a double-free in dialog_changed()
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Unti…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 an…
-
Medium 5.7
Junos OS and Junos OS Evolved: Concurrent deletion of a routing-instance and receipt of an SNMP request cause an RPD crash
A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-…
-
Medium 6.5
Envoy Proxy use after free when route hash policy is configured with cookie attributes
Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed i…
-
Medium 5.3
@fastly/js-compute use-after-free in some host call implementations
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding …
-
Medium 5.3
GPAC MP4Box loader_xmt.c xmt_node_end use after free
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use aft…
-
Medium 5.9
Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` b…
-
Medium 5.9
Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `R…
-
Medium 6.7
Use After Free in Audio
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
-
Medium 6.7
Use After Free in Audio
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
-
Medium 5.4
Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially ex…
-
Medium 5.3
NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak pre…
-
Medium 6.2
fbdev: imsttfb: fix a resource leak in probe
In the Linux kernel, the following vulnerability has been resolved: fbdev: imsttfb: fix a resource leak in probe I've re-written the error handling but the bug is that if init_imstt() fails we need to call iounmap(par->cmap_regs).
-
Medium 4.4
wifi: ath11k: fix htt pktlog locking
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix htt pktlog locking The ath11k active pdevs are protected by RCU but the htt pktlog handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critica…
-
Medium 6.2
blktrace: Fix uaf in blk_trace access after removing by sysfs
In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace…
-
Medium 5.5
Use-After-Free in Service for Hardware Support App for Fingerprint Driver
Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App.
-
Medium 5.7
HDF5 Library through 1.14.3 has a SEGV in H5T_close_real in H5T.c, resulting in a corrupted instruction pointer.
-
Medium 6.5
Hmdfs has a use after free vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free.
-
Medium 6.5
MSDP has a use after free vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free.
-
Medium 6.7
Use After Free in HLOS
Memory corruption when multiple listeners are being registered with the same file descriptor.
-
Medium 5.5
CODESYS: Use after free vulnerability through corrupted project files
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.
-
Medium 5.1
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the use…