CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Telephony Service Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Modern Device Management (MDM) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +3 more +5 moreMicrosoft Brokering File System Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +3 more +5 moreWindows MIDI Service Module Elevation of Privileges Vulnerability7.0 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Push Notifications Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWinlogon Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +7 more +9 moreWindows Bind Filter Driver Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Bind Filter Driver Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows DHCP Client Remote Code Execution Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Graphics Kernel Elevation of Privilege Vulnerability7.0 High
- intel proset\/wireless wifiUse after free for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel...5.9 Medium
- zoom communications clientsZoom Clients - Use After Free8.3 High
- vimVim: Use-after-free in JSON Decoding3.3 Low
- siemens solid edge se2025, solid edge se2026 +1 moreA vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid...7.3 High
- siemens solid edge se2025, solid edge se2026 +1 moreA vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid...7.3 High
- op-tee optee osOP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT8.4 High
- linuxgpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings7.8 High
- linuxxfrm: fix stale skb->prev after async crypto steals a GSO segment9.8 Critical
- linuxwifi: cfg80211: cancel sched scan results work on unregister7.5 High
- linuxwifi: mac80211: defer link RX stats percpu free to RCU8.8 High
- linuxbpf: Fix UAF in sock clone early bailouts7.8 High
- linuxppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF7.8 High
- linuxnet/iucv: take a reference on the socket found in afiucv_hs_rcv()8.8 High
- linuxBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update7.8 High
- linuxBluetooth: hci_sync: extend conn_hash lookup critical sections8.8 High
- linuxBluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds7.8 High
- linuxdrm/xe/guc: Keep scheduler timeline name alive7.8 High
- linuxksmbd: pin conn during async oplock break notification9.8 Critical
- linuxnet/sched: act_tunnel_key: Defer dst_release to RCU callback7.8 High
- linuxusb: core: sysfs: add lock to bos_descriptors_read()7.8 High
- linuxrds: drop incoming messages that cross network namespace boundaries7.8 High
- linuxrds: tcp: unregister sysctl before tearing down listen socket7.8 High
- linuxbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()7.8 High
- linuxdrm/xe: Hold a dma-buf reference for imported BOs7.8 High
- linuxALSA: seq: close a re-opened queue timer in the destructor7.8 High
- linuxALSA: timer: drain a slave's callback before its master detaches it7.8 High
- linuxwifi: ath6kl: fix use-after-free in aggr_reset_state()8.8 High
- linuxmisc: nsm: pin the module while the device is open7.8 High
- linuxsctp: avoid auth_enable sysctl UAF during netns teardown7.8 High
- linuxlibceph: refresh auth->authorizer_buf{,_len} after authorizer update9.8 Critical
- linuxlibceph: remove debugfs files before client teardown7.8 High
- linuxfscrypt: Add missing superblock check in find_or_insert_direct_key()7.8 High
- linuxphonet: pep: fix use-after-free in pep_get_sb()9.8 Critical
- linuxnet/iucv: fix use-after-free of a severed iucv_path8.8 High
- linuxila: reload IPv6 header after pskb_may_pull in checksum adjust9.8 Critical
- linuxpppoe: reload header pointer after dev_hard_header()7.8 High
- linuxtipc: clear sock->sk on the failed-insert path in tipc_sk_create()9.8 Critical
- linuxdrm/amdgpu: invoke pm_genpd_remove() before freeing genpd7.8 High
- zephyrproject zephyrUse-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock3.6 Low
- Show moreLoading…