CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 morebpf: Fix stale offload->prog pointer after constant blinding7.8 High
- linux, linux kernel +1 morebpf: Fix use-after-free in offloaded map/prog info fill7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morebpf: fix mm lifecycle in open-coded task_vma iterator7.8 High
- linux, linux kernel, red hat enterprise linux 10 +8 more +10 moreBluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp8.8 High
- linux, linux kernel +1 morecrypto: hisilicon/sec2 - prevent req used-after-free for sec9.8 Critical
- linux, linux kernel +1 moreksmbd: fix use-after-free from async crypto on Qualcomm crypto engine9.8 Critical
- linux, linux kernel +1 moreocfs2: validate bg_bits during freefrag scan7.1 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morebpf, sockmap: Take state lock for af_unix iter7.8 High
- linux, linux kernel +1 moregreybus: raw: fix use-after-free on cdev close7.8 High
- linux, linux kernel +1 moregreybus: raw: fix use-after-free if write is called after disconnect7.8 High
- linux, linux kernel +1 morenet/sched: taprio: fix use-after-free in advance_sched() on schedule switch7.8 High
- linux, linux kernel +1 moreksmbd: fix use-after-free in smb2_open during durable reconnect9.8 Critical
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreice: fix double-free of tx_buf skb7.8 High
- linux, linux kernel, red hat enterprise linux 10 +19 more +21 moreipv6: fix possible UAF in icmpv6_rcv()9.8 Critical
- linux, linux kernel +1 moreaf_unix: Drop all SCM attributes for SOCKMAP.7.8 High
- linux, linux kernel +1 morenet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()9.8 Critical
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moredrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morefutex: Drop CLONE_THREAD requirement for private default hash alloc7.8 High
- linux, linux kernel +1 morenet: ena: PHC: Fix potential use-after-free in get_timestamp7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moredrm/xe/dma-buf: handle empty bo and UAF races7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moredrm/xe/dma-buf: fix UAF with retry loop7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove7.8 High
- linux, linux kernel, red hat enterprise linux 10 +10 more +12 morenet: skbuff: fix missing zerocopy reference in pskb_carve helpers7.8 High
- curlUAF after pause in socket callback7.3 High
- curlHTTP/2 stream-dependency tree UAF9.8 Critical
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moresctp: purge outqueue on stale COOKIE-ECHO handling9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moresctp: diag: reject stale associations in dump_one path7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nf_queue: hold bridge skb->dev while queued7.8 High
- gpacA use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid...5.5 Medium
- gpacA use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c)...7.5 High
- gpacA use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC...5.0 Medium
- dhcpcd project dhcpcddhcpcd Heap Use-After-Free via Control Socket Handling5.7 Medium
- dhcpcd project dhcpcddhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW6.0 Medium
- gnome libxml2libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling7.0 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks...4.9 Medium
- msgpack messagepack, msgpack-python +1 moreMessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error7.5 High
- ohler55 ojOj: Use-After-Free in Oj::Parser SAJ Long Key Callback6.3 Medium
- ohler55 ojOj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking6.3 Medium
- ohler55 ojOj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling6.3 Medium
- ohler55 ojOj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation2.1 Low
- ohler55 ojOj : Use-After-Free in Oj::Doc Iterators via Reentrant Close2.1 Low
- ohler55 ojOj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle6.3 Medium
- nokogiriNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`1.7 Low
- nokogiriNokogiri: Possible Use-After-Free in XInclude Processing2.2 Low
- nokogiriNokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime1.7 Low
- nokogiriNokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type1.7 Low
- nokogiriNokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception1.7 Low
- linux, linux kernel, red hat enterprise linux 10 +10 more +12 morebpf: Free reuseport cBPF prog after RCU grace period.7.8 High
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()6.5 Medium
- cloudflare quicheUse-after-free in connection ID iterator and FFI functions5.6 Medium
- Show moreLoading…