CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 moreHID: letsketch: fix UAF on inrange_timer at driver unbind7.8 High
- linux, linux kernel +1 moreHID: appleir: fix UAF on pending key_up_timer in remove()7.8 High
- linux, linux kernel +1 moreHID: lg-g15: cancel pending work on remove to fix a use-after-free7.8 High
- linux, linux kernel +1 morebpf: Allow LPM map access from sleepable BPF programs7.8 High
- linux, linux kernel +1 moreusb: free iso schedules on failed submit7.8 High
- linux, linux kernel +1 moreusb: gadget: udc: Fix use-after-free in gadget_match_driver7.8 High
- linux, linux kernel +1 moreUSB: idmouse: fix use-after-free on disconnect race7.8 High
- linux, linux kernel +1 moreUSB: ldusb: fix use-after-free on disconnect race7.8 High
- linux, linux kernel +1 moreUSB: iowarrior: fix use-after-free on disconnect7.8 High
- linux, linux kernel +1 moreUSB: iowarrior: fix use-after-free on disconnect race7.8 High
- linux, linux kernel +1 moreUSB: legousbtower: fix use-after-free on disconnect race7.8 High
- linux, linux kernel +1 moreusb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove7.8 High
- linux, linux kernel +1 morecrypto: loongson - Remove broken and unused loongson-rng7.8 High
- linux, linux kernel +1 morecrypto: qat - protect service table iterations with service_lock7.8 High
- linux, linux kernel +1 morespi: fsl-lpspi: terminate the RX channel on TX prepare failure path9.8 Critical
- linux, linux kernel +1 moreperf/aux: Fix page UAF in map_range()7.8 High
- linux, linux kernel +1 morefuse: re-lock request before returning from fuse_ref_folio()7.8 High
- linux, linux kernel +1 morefuse: clear intr_entry in fuse_resend and fuse_remove_pending_req7.8 High
- linux, linux kernel +1 morefuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues7.8 High
- linux, linux kernel +1 morefuse-uring: make a fuse_req on SQE commit only findable after memcpy7.8 High
- linux, linux kernel +1 morepwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()7.8 High
- linux, linux kernel +1 morefpga: region: fix use-after-free in child_regions_with_firmware()7.8 High
- linux, linux kernel +1 morepower: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()7.8 High
- linux, linux kernel +1 morefbdev: modedb: fix a possible UAF in fb_find_mode()7.8 High
- linux, linux kernel +1 moremm/damon/sysfs-schemes: delete tried region in regions_rmdirs()7.8 High
- linux, linux kernel +1 moresched_ext: Avoid UAF in scx_root_enable_workfn() init failure path7.8 High
- linux, linux kernel +1 morespi: ti-qspi: fix use-after-free after DMA setup failure7.8 High
- linux, linux kernel +1 morenetfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()9.8 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed7.8 High
- google chromeUse after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...8.8 High
- google chromeUse after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who...8.3 High
- google chromeUse after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...8.8 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination7.1 High
- nlnet labs unboundMemory corruption could lead to crash and denial of service5.9 Medium
- nlnet labs unboundPossible heap use-after-free in an error path when a DoT forwarded query is jostled out5.9 Medium
- code16 sharpSharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability8.9 High
- google chromeUse after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote...9.6 Critical
- google chromeUse after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who...8.8 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: use-after-free via data callbacks on closed channels4.3 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Disability Access APIs component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to invalid pointer in the Disability Access APIs component10.0 Critical
- mozilla firefox, thunderbird +1 moreInvalid pointer in the DOM: Bindings (WebIDL) component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Disability Access APIs component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Navigation component9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the WebRTC: Audio/Video component8.8 High
- apache foryApache Fory: Rust MetaString heap use-after-free7.3 High
- tex live liveTeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File6.8 Medium
- linux, linux kernel +1 morenet: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()7.8 High
- apple ipados, macos, safari +5 more +7 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...6.5 Medium
- linux, linux kernel +1 moreBluetooth: bnep: Fix UAF read of dev->name8.8 High
- Show moreLoading…