Weakness (CWE)
CWE-416: Use After Free
Variant
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,546 results · Feed
-
Medium 6.3
GNOME gvdb gvdb-builder.c gvdb_table_write_contents_async use after free
A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The na…
-
Critical 9.8CVE-2022-47939 EPSS 49%
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-afte…
-
Medium 5.5
An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_urin…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
Critical 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affe…
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
High 7.5
A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabili…
-
Critical 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Fire…
-
Medium 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*:…
-
Critical 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…
-
High 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
High 7.5
If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
High 8.8
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…
-
Medium 6.5
In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to…
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
Medium 6.5
When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory co…
-
High 7.8
Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having …
-
High 7.5
The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may…
-
Medium 6.2
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() func…
-
Medium 6.7
In ServiceInterface::HandleRequest of serviceinterface.cpp, there is a possible use after free. This could lead to loca…
-
High 7.8
In SurfaceFlinger::doDump of SurfaceFlinger.cpp, there is possible arbitrary code execution due to a use after free. Th…
-
Medium 6.7
In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to loc…
-
Medium 6.7
In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. T…
-
High 7.8
In TBD of aud_hal_tunnel.c, there is a possible memory corruption due to a use after free. This could lead to local esc…
-
Medium 5.5
In btif_a2dp_sink_command_ready of btif_a2dp_sink.cc, there is a possible out of bounds read due to a use after free. T…
-
High 7.8
In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local e…
-
High 7.8
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local e…
-
Medium 6.7
In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to lo…
-
Medium 6.7
In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.…
-
High 7.8
In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. This could lead to lo…
-
High 8.8CVE-2022-42867 EPSS 35%
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, ma…
-
High 7.8
A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer…
-
High 8.8
A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes requ…
-
High 8.8
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request…