Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
911 results · Clear filters · Feed
-
Medium 6.3
GPAC MP4Box os_thread.c gf_mx_v use after free
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit h…
-
Medium 6.5
IBM DataPower Gateway Use After Free
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
-
Medium 5.9
ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to f…
-
Medium 6.2
M17n-lib: heap use-after-free write in re_init_ic()
A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attem…
-
Medium 6.7
Use After Free in Windows WLAN Host
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
-
Medium 4.8
vgmstream TXTP File txtp_process.c make_group_random use after free
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patc…
-
Medium 6.7
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privileg…
-
Medium 6.7
In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege …
-
Medium 6.7
In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege …
-
Medium —
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects hold…
-
Medium 6.5
Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction
A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing multiple message bodies. During extraction, improper memory management triggers a use-a…
-
Medium 6.4
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could c…
-
Medium 5.3
PyPy pyexpat ExternalEntityParserCreate Use-After-Free
PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entit…
-
Medium 5.5
Use After Free in Wireshark
ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service
-
Medium 5.3
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction:…
-
Medium 4.6
Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c …
-
Medium 5.5
Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook
A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash.
-
Medium 5.9
Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClient…
-
Medium 4.6
Heap Use-After-Free in H5T__conv_f_f
A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subseque…
-
Medium 5.9
qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…
-
Medium 5.9
Use-after-free in DoH stream cleanup code path
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brin…
-
Medium 6.5
Use-after-free in DoQ stream output buffer on reset re-transmission
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a…
-
Medium 6.7
In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. This could…
-
Medium 6.4
In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead …
-
Medium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Medium 5.3
Use-after-free in the Audio/Video: Web Codecs component
Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
Medium 6.3
GPAC base_scenegraph.c gf_node_get_name_and_id use after free
A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made pu…
-
Medium 5.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Medium 5.5
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7,…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPad…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8,…
-
Medium 5.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macO…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An a…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 6.8
it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a f…
-
Medium 5.9
Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_…
-
Medium 6.3
GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack re…