Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,482 results · Feed
-
High 7.0
Windows SMB Client Elevation of Privilege Vulnerability
Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows NetBIOS Elevation of Privilege Vulnerability
Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Event Collector Service Elevation of Privilege Vulnerability
Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows exFAT File System Elevation of Privilege Vulnerability
Use after free in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows USB Driver Elevation of Privilege Vulnerability
Use after free in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Filtering Platform (WFP) Elevation of Privilege Vulnerability
Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Remote Assistance Elevation of Privilege Vulnerability
Use after free in Windows Remote Assistance allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
Medium 5.3
Windows DNS Denial of Service Vulnerability
Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.
-
High 7.0
Windows NetBIOS Elevation of Privilege Vulnerability
Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Winsock Elevation of Privilege Vulnerability
Use after free in Winsock allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows OLE Information Disclosure Vulnerability
Use after free in Windows OLE allows an authorized attacker to disclose information locally.
-
High 8.1
Windows Domain Name Service Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows DIAL Client Elevation of Privilege Vulnerability
Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Connection Manager Service Elevation of Privilege Vulnerability
Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Push Notification Core Elevation of Privilege Vulnerability
Use after free in Windows Push Notification Core allows an authorized attacker to elevate privileges locally.
-
Medium 4.9
Role: DNS Server Denial of Service Vulnerability
Use after free in DNS Server allows an authorized attacker to deny service over a network.
-
High 7.0
Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Event Logging Service Elevation of Privilege Vulnerability
Use after free in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows User Manager Service Elevation of Privilege Vulnerability
Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Diagnostic Policy Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Smart Card Elevation of Privilege Vulnerability
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.