Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,545 results · Feed
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
High 8.4
Use After Free in Graphics Linux
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
-
High 8.4
Use After Free in Automotive Telematics
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
-
High 7.5
Use After Free in WLAN Host
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when kernel driver attempts to trigger hardware fences.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption while processing graphics kernel driver request to create DMA fence.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
Medium 4.2
Vim < v9.1.0648 has a double-free in dialog_changed()
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Unti…
-
Critical 9.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 an…
-
High 7.5
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS …
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 an…
-
High 8.4
Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will aff…
-
High 8.8
Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap cor…
-
High 7.5
Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user …
-
High 8.8
Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit hea…
-
High 8.8
Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to insta…
-
High 8.8
Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a use…
-
High 8.8
Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user …
-
Low 3.1
Loss of confidentiality due to potential race condition in Bluetooth controller Connection_Handle reuse
Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK:…
-
High 7.8
greybus: Fix use-after-free bug in gb_interface_release due to race condition.
In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will …
-
Medium 5.7
Junos OS and Junos OS Evolved: Concurrent deletion of a routing-instance and receipt of an SNMP request cause an RPD crash
A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-…
-
High 7.8
In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free. This could le…
-
High 7.3
In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could…
-
High 8.4
In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could l…
-
High 7.5
Xbox Wireless Adapter Remote Code Execution Vulnerability
Xbox Wireless Adapter Remote Code Execution Vulnerability
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
-
High 8.8
Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
-
High 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
-
High 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
-
High 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
-
High 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Graphics Component Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability