Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,545 results · Feed
-
High 7.8
mm: zswap: properly synchronize freeing resources during CPU hotunplug
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation i…
-
High 8.8
Liteos_a has an use after free vulnerability
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
-
Medium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may caus…
-
Medium 6.3
Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap co…
-
Medium 5.4
Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corr…
-
Critical 9.8
Use-after-free during concurrent delazification
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8
Use-after-free in Custom Highlight
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8
Use-after-free in XSLT
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Medium 6.3
rust openssl ssl::select_next_proto use after free
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where …
-
High 7.8
Use After Free in WLAN Host Communication
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affec…
-
High 7.8
zram: fix potential UAF of zram table
In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table …
-
High 7.8
GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 8.8
Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit he…
-
High 8.4
In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. Th…
-
High 8.4
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation…
-
High 8.4
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation…
-
High 8.4
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privi…
-
High 8.4
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privi…
-
Medium 5.5
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been fre…
-
High 8.1
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.2 and iPadOS 18.2, …
-
Critical 10.0
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, …
KEV Jan 29, 2025 -
High 8.1
xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
-
High 7.8
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_b…
-
High 7.8
ipvlan: Fix use-after-free in ipvlan_get_iflink().
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch. ipvlan does not hold a refcnt of the lower device unlike vlan …
-
High 7.8
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…
-
High 7.8
RDMA/siw: Remove direct link to net_device
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Remove direct link to net_device Do not manage a per device direct link to net_device. Rely on associated ib_devices net_device management, not doubling the effort locally. A badly …
-
High 7.8
net/mlx5e: Skip restore TC rules for vport rep without loaded flag
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while t…
-
High 7.8
RDMA/rxe: Remove the direct link to net_device
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following anal…
-
High 7.8
ila: serialize calls to nf_register_net_hooks()
In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issu…
-
High 7.8
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
In the Linux kernel, the following vulnerability has been resolved: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which fre…
-
High 7.8
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_ge…
-
High 7.8
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-…
-
High 7.8CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
Microsoft Brokering File System Elevation of Privilege Vulnerability
-
Critical 9.8
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability