Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,534 results · Feed
-
High 8.8
Use-after-free in the Widget: Win32 component
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the Graphics component
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
-
High 8.8
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the Networking component
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the DOM: Navigation component
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the XML component
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
-
High 8.8
Use-after-free in the Disability Access APIs component
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
Medium 5.3
Use-after-free in the Audio/Video: Web Codecs component
Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
Medium 6.3
GPAC base_scenegraph.c gf_node_get_name_and_id use after free
A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made pu…
-
High 7.3
GPAC Compositor media_object.c gf_mo_get_od_id use after free
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remo…
-
High 7.3
luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can b…
-
Low 3.3
GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is…
-
Low 3.3
GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local a…
-
High 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Medium 5.5
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7,…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPad…
-
High 7.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8,…
-
Medium 5.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macO…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An a…
-
High 7.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 5.5
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 6.8
it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a f…
-
Medium 5.9
Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_…
-
Medium 6.3
GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack re…
-
Medium 5.4
GPAC MP4Box base_scenegraph.c gf_node_get_name use after free
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit …
-
Medium 6.3
GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. …
-
High 8.3
Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free
A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option resu…
-
Medium 6.3
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the a…
-
Medium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2…