CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeUse after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to...8.8 High
- google chromeUse after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote...9.6 Critical
- google chromeUse after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who...8.3 High
- google chromeUse after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to...9.0 Critical
- google chromeUse after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed...9.6 Critical
- google chromeUse after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote...9.6 Critical
- mozilla thunderbirdInformation disclosure due to malicious IMAP server response7.5 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component5.4 Medium
- mozilla firefox, thunderbird +1 morePrivilege escalation due to use-after-free in the Graphics: WebGPU component8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the Audio/Video component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: GC component5.4 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Security component9.6 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Audio/Video component5.4 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Navigation component9.6 Critical
- hdfgroup hdf5Heap Use-After-Free in H5T__conv_f_f4.6 Medium
- arm ltd 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory7.8 High
- arm ltd 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory7.8 High
- google androidIn multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error...6.7 Medium
- google androidIn multiple locations, there is a possible use-after-free due to a race condition. This could...7.0 High
- arm ltd 5th gen gpu architecture kernel driver, valhall gpu kernel driver +1 moreMali GPU Kernel Driver allows access to already freed memory7.8 High
- google androidIn multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race...6.4 Medium
- google androidIn multiple locations, there is a possible use-after-free due to a race condition. This could...6.4 Medium
- google androidIn multiple locations, there is a possible use-after-free due to a logic error in the code. This...9.8 Critical
- google androidIn multiple locations, there is a possible use-after-free due to improper locking. This could...8.4 High
- google androidIn multiple locations, there is a possible use-after-free due to a race condition. This could...8.8 High
- imagination technologies graphics ddkGPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags7.8 High
- arm ltd 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory5.1 Medium
- arm ltd 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory4.0 Medium
- arm ltd 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +2 moreMali GPU Kernel Driver allows access to already freed memory4.4 Medium
- zephyrproject zephyrSiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt6.4 Medium
- valkey-io valkeyvalkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free2.1 Low
- o6 automation gmbh open62541open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free6.9 Medium
- systerel s2opcSysterel S2OPC subscription_mgr.c use after free5.3 Medium
- microsoft edge (chromium-based), edge chromium, edge for android +4 more +6 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability4.3 Medium
- envoyproxy envoyEnvoy: oghttp2 upstream trailers incorrect handling7.5 High
- envoyproxy envoyEnvoy: use-after-free in QUIC on internal redirects7.5 High
- envoyproxy envoyEnvoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault5.9 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can use a Sieve script with the editheader extension to...9.1 Critical
- watchguard fireware osFireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)8.7 High
- yhirose cpp-httplibcpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()8.2 High
- redis, redis software (enterprise) +1 moreRedis TLS pending-data list use-after-free7.5 High
- opensslUse-After-Free in X.509 Extension Cache Under Concurrent Use7.5 High
- freebsdKernel use-after-free via tty ioctls7.0 High
- freebsdKernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl7.8 High
- freebsdUse-after-free in unix SOCK_STREAM message handling7.8 High
stomperUbuntuStomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on...9.8 CriticalstomperUbuntuStomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE...7.5 High- google chromeUse after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote...9.6 Critical
- google chromeUse after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute...8.8 High
- Show moreLoading…