CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 22h2 +13 more +15 moreWindows Graphics Component Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreDirectX Graphics Kernel Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability7.8 High
- microsoft office, powerpoint, 365 apps +6 more +8 moreMicrosoft PowerPoint Remote Code Execution Vulnerability7.8 High
- microsoft office, 365 apps, 365 apps for enterprise +10 more +12 moreMicrosoft Office Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows UI XAML Phone DatePickerFlyout Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +21 more +23 moreWindows Connected Devices Platform Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows SMB Client Remote Code Execution Vulnerability4.8 Medium
- microsoft .net 6.0, microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +11 more +13 moreEOL ASP.NET 6.0 Remote Code Execution Vulnerability8.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morecrypto: qat - flush misc workqueue during device shutdown5.5 Medium
- linux, linux kernel +1 moreopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE7.8 High
- linux, linux kernel +1 moremedia: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls7.8 High
- linux, linux kernel +1 moreio_uring/futex: ensure io_futex_wait() cleans up properly on failure7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +5 more +7 morefs/buffer: fix use-after-free when call bh_read() helper7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +3 more +5 moreftrace: Also allocate and copy hash for reading of filter files7.8 High
- linux, linux kernel +1 morenet/smc: fix UAF on smcsk after smc_listen_out()9.8 Critical
usd-corePyPIPixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution9.4 Critical- debian linux, linux kernel, siemens simatic cn 4100 +3 more +5 morenfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()9.8 Critical
- linux, linux kernel +1 morehabanalabs: fix UAF in export_dmabuf()7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +3 more +5 moredrbd: add missing kref_get in handle_write_conflicts9.8 Critical
- linux, linux kernel +1 moredrm/xe: Make dma-fences compliant with the safe access rules7.8 High
- envoyproxy envoyEnvoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults7.5 High
- meh.schizofreni rust-ffmpegAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability...7.5 High
- google android, mediatek, inc. mt2718, mt6853, mt6877, mt6893, mt6899, mt6991, mt8196, mt8676, mt8678, mt8775, mt8786, mt8788e, mt8791t, mt8792, mt8796, mt8883, mt8893 +1 moreIn geniezone, there is a possible memory corruption due to use after free. This could lead to...6.7 Medium
- google android, mediatek, inc. mt6899, mt6989, mt6991, mt8676, mt8678 +1 moreIn mbrain, there is a possible memory corruption due to use after free. This could lead to local...7.8 High
- google android, linuxfoundation yocto, mediatek, inc. mt2718, mt2735, mt6739, mt6761, mt6765, mt6768, mt6781, mt6789, mt6835, mt6853, mt6855, mt6877, mt6878, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6893, mt6895, mt6897, mt6899, mt6980d, mt6983, mt6985, mt6989, mt6990, mt6991, mt8169, mt8186, mt8188, mt8676, mt8678, mt8696, mt8775, mt8792, mt8796 +1 more +3 moreIn monitor_hang, there is a possible memory corruption due to use after free. This could lead to...7.8 High
- google android, android runtime +1 moreIn multiple locations, there is a possible way to escape chrome sandbox to attack android...8.8 High
- google androidIn SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after...8.0 High
- google androidIn multiple locations, there is a possible memory corruption due to a use after free. This could...7.8 High
- arm 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory5.3 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moretls: separate no-async decryption request handling from async9.8 Critical
- google chromeUse after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to...8.8 High
- podofoPoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after free4.8 Medium
- appneta tcpreplayappneta tcpreplay tcprewrite get.c get_l2len_protocol use after free4.8 Medium
- appneta tcpreplayappneta tcpreplay tcprewrite edit_packet.c fix_ipv6_checksums use after free4.8 Medium
- debian linux, linux kernel +1 morenet: appletalk: Fix use-after-free in AARP proxy probe7.8 High
- linux, linux kernel +1 morewifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()7.8 High
- debian linux, linux kernel +1 moreproc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al7.8 High
- linux, linux kernel +1 moref2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic7.8 High
- linux, linux kernel +1 morezloop: fix KASAN use-after-free of tag set7.8 High
- debian linux, linux kernel +1 morevsock: Do not allow binding to VMADDR_PORT_ANY7.8 High
- appneta tcpreplayappneta tcpreplay tcprewrite edit_packet.c untrunc_packet use after free4.8 Medium
- linux, linux kernel +1 moredrm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a07.8 High
- linux, linux kernel +1 moredrm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code7.8 High
- linux, linux kernel +1 morexen: fix UAF in dmabuf_exp_from_pages()7.8 High
- linux, linux kernel +1 moreiommu/vt-d: Fix UAF on sva unbind with pending IOPFs7.8 High
- Show moreLoading…