Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

6,546 results · Feed

  • Critical 9.8
    CVE-2018-20997

    Use after free in openssl

    An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.

    openssl crates.io
  • Critical 9.8
    CVE-2019-15552

    Use after free in libflate

    An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.

    libflate rust-libflate Debian crates.io
  • Medium 4.6
    CVE-2019-15213

    An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2019-13514

    In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may t…

  • Unscored —
    CVE-2019-13510 EPSS 12%

    Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A malicio…

  • Unscored —
    CVE-2019-6822

    A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code executi…

    Zelio Soft Zelio Soft 2 V5.2 and prior
  • Medium 6.5
    CVE-2019-5786 Exploited Public exploit EPSS 61%

    Use-After-Free in puppeteer

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
    KEV May 23, 2022
  • High 7.0
    CVE-2019-3896

    A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacke…

    The Linux Foundation Kernel linux-azure linux Debian Ubuntu
  • High 7.8
    CVE-2019-6763

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • Low 3.3
    CVE-2019-6773

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6771

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • High 7.8
    CVE-2019-6762

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.…

    Foxit PhantomPDF
  • Low 3.3
    CVE-2019-6758

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • Low 3.3
    CVE-2019-6772

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • High 7.8
    CVE-2019-6761

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.…

    Foxit Reader
  • Low 3.3
    CVE-2019-6770

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • High 7.8
    CVE-2019-6757

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16…

    Foxit Reader
  • High 7.0
    CVE-2019-6768

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • Low 3.3
    CVE-2019-6766

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Reader
  • High 7.8
    CVE-2019-6769

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • High 7.0
    CVE-2019-6767

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.…

    Foxit Reader
  • Low 3.3
    CVE-2019-6756

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Phant…

    Foxit PhantomPDF
  • Critical 9.8
    CVE-2019-0708 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 8.1
    CVE-2019-5018

    An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially …

    sqlite3 sqlite Debian Alpine
  • Low 3.3
    CVE-2019-3885

    A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive …

    ClusterLabs pacemaker pacemaker pacemaker Debian Ubuntu
  • Unscored —
    CVE-2019-6556

    When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 …

    Omron CX-Programmer within CX-One ICS / OT
  • High 7.8
    CVE-2019-0211 Exploited Public exploit EPSS 65%

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…

    Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • Medium 5.3
    CVE-2019-3829 EPSS 59%

    A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability i…

    gnutls gnutls gnutls28 gnutls28 Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-3817

    A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attack…

    libcomps libcomps
  • Unscored —
    CVE-2019-6730

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User …

    Foxit Reader
  • Unscored —
    CVE-2019-6734

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Phant…

    Foxit PhantomPDF
  • Unscored —
    CVE-2019-6727

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User …

    Foxit Reader
  • Medium 5.5
    CVE-2019-7560

    Boolector use after free

    In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.

    pyboolector PyPI
  • Unscored —
    CVE-2018-7817

    A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code e…

    Schneider Electric Zelio Soft 2 v5.1 and prior versions ICS / OT
  • Medium 5.3
    CVE-2019-7317

    png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…

    thunderbird firefox thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2018-17672

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.…

    Foxit Reader
  • Unscored —
    CVE-2018-17658

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.…

    Foxit Reader
  • Unscored —
    CVE-2018-17650

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.…

    Foxit Reader
  • Unscored —
    CVE-2018-17674

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.…

    Foxit Reader
  • Unscored —
    CVE-2018-17695

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.…

    Foxit PhantomPDF