CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 morecrypto: ccp - Fix use-after-free on error path7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: cfg80211: cancel rfkill_block work in wiphy_unregister()7.8 High
- linux, linux kernel +1 moreipmi: Fix use-after-free and list corruption on sender error7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morebpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim7.8 High
- linux, linux kernel +1 morescsi: pm8001: Fix use-after-free in pm8001_queue_command()7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: libertas: fix use-after-free in lbs_free_adapter()7.8 High
- apple ipados, macos, tvos +3 more +5 moreA use after free issue was addressed with improved memory management. This issue is fixed in iOS...7.1 High
- apple macosA use-after-free issue was addressed with improved memory management. This issue is fixed in...6.5 Medium
- apple ipados, macos, safari +21 more +23 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26...4.3 Medium
- apple ipados, macos, tvos +4 more +6 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...6.5 Medium
- apple ipados, macos, tvos +4 more +6 moreA use after free issue was addressed with improved memory management. This issue is fixed in iOS...6.2 Medium
- apple ipados, macos, safari +19 more +21 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26...6.5 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Graphics: Canvas2D component10.0 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine component9.8 Critical
- no-chicken echo-mateUse After Free in No-Chicken Echo-Mate6.4 Medium
- no-chicken echo-mateUse-After-Free Vulnerability in No-Chicken/Echo-Mate7.3 High
- google chromeUse after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to...8.8 High
- google chromeUse after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to...8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the Widget: Cocoa component9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Layout: Text and Fonts component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the CSS Parsing and Computation component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to use-after-free in the Disability Access APIs component10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreRace condition, use-after-free in the Graphics: WebRender component7.5 High
- xnview nconvertXnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file6.2 Medium
- libfuse, red hat enterprise linux 7, enterprise linux 8 +2 moreUse After Free in libfuse7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: always walk all pending catchall elements7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moremacvlan: observe an RCU grace period in macvlan_common_newlink() error path7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: unconditionally bump set->nelems before insertion7.8 High
- pjsip, pjsip pjproject +1 morePJSIP has ICE session use-after-free race conditions8.0 High
- google chromeUse after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who...8.8 High
- google chromeUse after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a...8.8 High
- google chromeUse after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- google chromeUse after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- google chromeUse after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to...8.8 High
- samtoolssamtools mpileup has use-after-free leading to an invalid read6.9 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks7.8 High
- linux, linux kernel +1 morebtrfs: do not free data reservation in fallback from inline due to -ENOSPC7.5 High
- linux, linux kernel +1 moreperf/core: Fix refcount bug and potential UAF in perf_mmap7.8 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators8.7 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreLibsoup: libsoup: denial of service via use-after-free in http/2 server5.3 Medium
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race Condition5.3 Medium
- quickjs-ng quickjsquickjs-ng quickjs quickjs.c js_iterator_concat_return use after free4.8 Medium
- google chromeUse after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote...8.8 High
- google chromeuse after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker...7.5 High
- google chromeUse after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to...8.8 High
- Show moreLoading…