CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreRemote Desktop Client Remote Code Execution Vulnerability8.8 High
- microsoft 365 apps, 365 apps for enterprise, office 365 for mac +7 more +9 moreMicrosoft Office Word Remote Code Execution Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Installer Elevation of Privilege Vulnerability7.0 High
- microsoft windows security appWindows Security App Elevation of Privilege Vulnerability7.0 High
- adobe framemaker 2022, framemaker 2026 +1 moreAdobe Framemaker | Use After Free (CWE-416)7.8 High
- zephyrproject zephyrBluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping6.5 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreMongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline6.0 Medium
- keepassxcKeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map4.3 Medium
- freerdpFreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect8.7 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Animation component5.4 Medium
- mozilla firefox, thunderbird +1 moreRace condition, use-after-free in the Graphics: Text component4.2 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Workers component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Storage: Bucket File System component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Audio/Video: Playback component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Streams component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine: JIT component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Animation component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Audio/Video component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the SVG component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component5.4 Medium
- mozilla firefox, thunderbird +1 moreRace condition, use-after-free in the Graphics: CanvasWebGL component4.2 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the XML component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Bindings (WebIDL) component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Crash Reporting component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: Canvas2D component5.4 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: Text component5.4 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Networking component9.6 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Storage: IndexedDB component5.4 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component9.6 Critical
- zephyrproject zephyrUse-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails5.9 Medium
- progress software corporation marklogic serverUse-after-free in Progress MarkLogic Server JavaScript engine integration8.0 High
- imagemagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG20006.3 Medium
- freerdpFreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path6.0 Medium
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 7 +2 more +4 moreMutter: mutter: client-triggered use-after-free in wayland color-management icc image description path7.8 High
- samsung mobile devicesUse after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to...8.9 High
- zephyrproject zephyrUse-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown7.5 High
gpacUbuntuGPAC MP4Box filter_queue.c gf_fq_pop use after free5.3 MediumgpacUbuntuGPAC MP4Box os_thread.c gf_mx_v use after free5.3 Medium- google gvisorCode Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile8.5 High
- falkordbDouble free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB9.3 Critical
- x.org xwayland, the xorg project xorg-x11-server +1 more.Org Server XInput Passive Grab Use-After-Free5.5 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Use After Free6.5 Medium
- the xorg project xorg-x11-server, x.org xwayland +1 more.Org Server Present Extension Use-After-Free6.8 Medium
- imagemagickImageMagick: Use-After-Free in RSVG decoder that is build without cairo support5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreM17n-lib: heap use-after-free write in re_init_ic()6.2 Medium
- ggml-org llama.cppllama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser9.2 Critical
- Show moreLoading…