Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,542 results · Feed
-
High 7.0
Desktop Window Manager Elevation of Privilege Vulnerability
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.0
Windows Backup Engine Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
-
Critical 9.8
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
-
High 7.0
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability
Use after free in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
-
High 8.8
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.
-
Critical 9.8
Microsoft QUIC Remote Code Execution Vulnerability
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows DNS Server Remote Code Execution Vulnerability
Use after free in Windows DNS allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Schannel Elevation of Privilege Vulnerability
Use after free in Windows Schannel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kerberos Elevation of Privilege Vulnerability
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Telephony Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Telephony Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Microsoft Brokering File System Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Push Notifications Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows MIDI Service Module Elevation of Privileges Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 7.0
Winlogon Elevation of Privilege Vulnerability
Use after free in Winlogon allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows DHCP Client Remote Code Execution Vulnerability
Use after free in Windows DHCP Client allows an authorized attacker to execute code locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 5.9
Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of …
-
High 8.3
Zoom Clients - Use After Free
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
-
Low 3.3
Vim: Use-after-free in JSON Decoding
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read …
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All vers…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All vers…
-
Medium 6.7
OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT
OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TA_FL…
-
High 7.8
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The ca…
-
Critical 9.8
xfrm: fix stale skb->prev after async crypto steals a GSO segment
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…
-
High 7.5
wifi: cfg80211: cancel sched scan results work on unregister
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request i…
-
High 8.8
wifi: mac80211: defer link RX stats percpu free to RCU
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free…
-
High 7.8
bpf: Fix UAF in sock clone early bailouts
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of…