Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
910 results · Clear filters · Feed
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and …
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and …
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and …
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and …
-
Medium 6.2
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7…
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 5.3
Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the calle…
-
Medium 5.9
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the sh…
-
Medium 5.7
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, le…
-
Medium 5.4
Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processing an RTMP Abort (proto…
-
Medium 6.5
FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channe…
-
Medium 5.5
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows…
-
Medium 5.5
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 …
-
Medium 5.5
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.4
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (compon…
-
Medium 4.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.5
Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised th…
-
Medium 6.5
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbi…
-
Medium 6.5
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code ins…
-
Medium 6.5
Use after free in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engi…
-
Medium 6.5
Use after free in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute ar…
-
Medium 6.5
Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbit…
-
Medium 5.4
Use-after-free in S/MIME decryption during a security device password prompt
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it wa…
-
Medium 5.4
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.9
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a…
-
Medium 6.5
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them.…
-
Medium 5.5
michaelrsweet mxml mxml-file.c mxml_load_data use after free
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been d…
-
Medium 5.5
A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attacke…
-
Medium 5.5
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev…
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configure…
-
Medium 5.9
Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volu…
-
Medium 6.5
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string …
-
Medium 4.7
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a loc…
-
Medium 4.4
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) be…
-
Medium 4.3
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the …