Skip to content
OpenAdvisories

Weakness (CWE)

CWE-416: Use After Free

Variant

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a language that provides automatic memory management.

  2. Implementation

    When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE-416

All Critical High Medium Low Exploited only Public exploit

6,546 results · Feed

  • Unscored —
    CVE-2016-9591

    JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resu…

    JasPer jasper jasper Ubuntu
  • Unscored —
    CVE-2018-1166

    This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-…

    Joyent Joyent SmartOS
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • Unscored —
    CVE-2017-16732

    A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated…

  • Unscored —
    CVE-2017-16581

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16577

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16586

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16583

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16575

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16585

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16587

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-16576

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10959

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10958

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10957

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-14832

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-14833

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-14836

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-14834

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-14831

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10946

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10948

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10945

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10947

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.…

    Foxit Foxit Reader
  • Unscored —
    CVE-2017-10941

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.…

    Foxit Foxit Reader
  • High 7.5
    CVE-2017-9790

    Use after free in Apache Mesos

    When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with …

    Apache Software Foundation Apache Mesos org.apache.mesos:mesos Maven
  • High 7.8
    CVE-2017-0261 Exploited Public exploit EPSS 78%

    Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

    Microsoft Microsoft Office
    KEV Mar 3, 2022
  • High 7.8
    CVE-2017-0263 Exploited Public exploit EPSS 10%

    The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

    Microsoft Microsoft Windows Windows
    KEV Feb 10, 2022
  • Medium 6.2
    CVE-2016-9401

    popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.

    bash bash bash Debian Ubuntu Alpine
  • High 8.8
    CVE-2016-7892 Exploited EPSS 19%

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnera…

    KEV Mar 25, 2022
  • High 7.0
    CVE-2015-8963

    Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2016-5131

    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

    chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2016-3189 EPSS 16%

    Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash…

    bzip2 bzip2 bzip2 Debian Ubuntu Alpine
  • High 8.8
    CVE-2016-0984 Exploited Public exploit EPSS 55%

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High 7.0
    CVE-2015-6564

    Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-O…

    openssh openssh Debian Ubuntu
  • High 7.8
    CVE-2015-5122 Exploited Public exploit EPSS 87%

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5123 Exploited EPSS 19%

    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 1…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5119 Exploited Public exploit EPSS 99%

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2015-2360 Exploited EPSS 15%

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Serve…

    KEV May 25, 2022