Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,546 results · Feed
-
Unscored —
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorre…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a…
-
Unscored —
A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject cr…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable p…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
-
Medium —
iana-time-zone vulnerable to use after free in MacOS / iOS implementation
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced. The copied system time zone was released before its name was copied. If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`, ra…
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user conn…
-
Unscored —
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to cra…
-
High 7.5
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a c…
-
High 7.8
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —CVE-2022-1043 Public exploit
A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to co…
-
Unscored —
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…
-
High 7.5
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radi…
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race conditio…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0286.
-
Unscored —
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs whi…
-
Unscored —CVE-2021-3929 Public exploit
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-202…
-
Unscored —
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values fr…
-
High 7.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0260.
-
Unscored —
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_…
-
Unscored —
A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0246.
-
Unscored —
A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…
-
Unscored —CVE-2021-3975 Public exploit
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is call…
-
High 8.1
Double free or Use after Free in Value class of Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be …
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0225.
-
High 7.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0221.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0213.
-
High 7.8
arcreader use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
-
High 7.3
In exynos5_i2c_irq of (TBD), there is a possible out of bounds write due to a use after free. This could lead to local …
-
Medium 6.7
In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This cou…
-
High 7.8
Adobe Illustrator Font Parsing Use-After-Free Remote Code Execution Vulnerability
Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…
-
High 7.8
Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
-
Medium 5.5
Adobe Acrobat Reader Use-After-Free Memory leak
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
High 7.8
Adobe FrameMaker SVG File Parsing Use-After-Free Remote Code Execution Vulnerability
Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user int…
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Windows Defender Credential Guard Elevation of Privilege Vulnerability
Windows Defender Credential Guard Elevation of Privilege Vulnerability
-
Unscored —
A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get th…
-
Unscored —
A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw al…
-
High 7.5
Use-after-free in io_uring ad work_flags in Linux Kernel
io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts whi…