Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,546 results · Feed
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). T…
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). T…
-
Medium 6.8
A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…
-
Medium 6.8
A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…
-
High 8.8CVE-2021-30554 Exploited
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap c…
KEV Nov 3, 2021 -
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninj…
-
High 7.5
Use-after-free in BinDiff
An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7
-
High 8.8
Adobe Acrobat Reader use-after-free could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability when executing search queries through Javascript. An unauthenticated attacker could …
-
Critical 9.8
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-254…
-
Unscored —
A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resu…
-
Critical 9.8
Use After Free in Hermes
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application us…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
Unscored —CVE-2021-22901 EPSS 64%
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used whe…
-
Unscored —
A CWE-416: Use after free vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in…
-
Medium 6.4CVE-2021-25394 Exploited
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…
KEV Jun 29, 2023 -
Unscored —
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be p…
-
Unscored —
A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closu…
-
Unscored —
There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouve…
-
Unscored —
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0…
-
Unscored —
A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of se…
-
Unscored —
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrup…
-
Unscored —
A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which mi…
-
Unscored —
A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might le…
-
High 8.8CVE-2021-29256 Exploited
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information …
KEV Jul 7, 2023 -
Unscored —
A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early…
-
High 8.8CVE-2021-3518 EPSS 22%
Nokogiri Implements libxml2 version vulnerable to use-after-free
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, an…
-
Unscored —
A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-…
-
Unscored —
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
-
High 7.8
Linux kernel llcp_sock_bind/connect use-after-free
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A …
-
High 8.8
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …
KEV Nov 3, 2021 -
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…