CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11157 vulnerabilities reference this CWE, most recent first.
GHSA-5HHC-2XGQ-33GP
Vulnerability from github – Published: 2026-09-08 18:33 – Updated: 2026-09-08 18:33Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-70565"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:20:09Z",
"severity": "HIGH"
},
"details": "Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-5hhc-2xgq-33gp",
"modified": "2026-09-08T18:33:06Z",
"published": "2026-09-08T18:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70565"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70565"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HHF-628R-6JFJ
Vulnerability from github – Published: 2023-02-18 00:31 – Updated: 2023-02-18 00:31Adobe Premiere Rush version 2.6 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2023-22244"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-17T22:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Premiere Rush version 2.6 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-5hhf-628r-6jfj",
"modified": "2023-02-18T00:31:58Z",
"published": "2023-02-18T00:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22244"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/premiere_rush/apsb23-14.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HJ2-4MJX-W4VV
Vulnerability from github – Published: 2022-05-14 03:55 – Updated: 2022-05-14 03:55Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.
{
"affected": [],
"aliases": [
"CVE-2016-7910"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-11-16T05:59:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.",
"id": "GHSA-5hj2-4mjx-w4vv",
"modified": "2022-05-14T03:55:49Z",
"published": "2022-05-14T03:55:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7910"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/77da160530dd1dc94f6ae15a981f24e5f0021e84"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0892"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1297"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1298"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1308"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77da160530dd1dc94f6ae15a981f24e5f0021e84"
},
{
"type": "WEB",
"url": "http://source.android.com/security/bulletin/2016-11-01.html"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94135"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HJC-XC74-XXJG
Vulnerability from github – Published: 2026-07-24 18:31 – Updated: 2026-08-17 21:31In the Linux kernel, the following vulnerability has been resolved:
fbdev: modedb: fix a possible UAF in fb_find_mode()
If mode_option is NULL, it is assigned from mode_option_buf:
if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_buf; }
Later, name is assigned from mode_option:
const char *name = mode_option;
However, mode_option_buf is freed before name is no longer used:
kfree(mode_option_buf);
while name is still accessed by:
if ((name_matches(db[i], name, namelen) ||
Since name aliases mode_option_buf, this may result in a use-after-free.
Fix this by extending the lifetime of mode_option_buf until the end of the function by using scope-based resource management for cleanup.
{
"affected": [],
"aliases": [
"CVE-2026-64245"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T16:16:53Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: modedb: fix a possible UAF in fb_find_mode()\n\nIf mode_option is NULL, it is assigned from mode_option_buf:\n\n if (!mode_option) {\n fb_get_options(NULL, \u0026mode_option_buf);\n mode_option = mode_option_buf;\n }\n\nLater, name is assigned from mode_option:\n\n const char *name = mode_option;\n\nHowever, mode_option_buf is freed before name is no longer used:\n\n kfree(mode_option_buf);\n\nwhile name is still accessed by:\n\n if ((name_matches(db[i], name, namelen) ||\n\nSince name aliases mode_option_buf, this may result in a\nuse-after-free.\n\nFix this by extending the lifetime of mode_option_buf until the end of the\nfunction by using scope-based resource management for cleanup.",
"id": "GHSA-5hjc-xc74-xxjg",
"modified": "2026-08-17T21:31:12Z",
"published": "2026-07-24T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64245"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HP7-2MV5-P69R
Vulnerability from github – Published: 2022-12-14 21:30 – Updated: 2025-04-22 18:32A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se
{
"affected": [],
"aliases": [
"CVE-2022-46342"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-14T21:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se",
"id": "GHSA-5hp7-2mv5-p69r",
"modified": "2025-04-22T18:32:00Z",
"published": "2022-12-14T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46342"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:0045"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:0046"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-46342"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2151757"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-30"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5304"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HPC-PQRR-8J6M
Vulnerability from github – Published: 2026-01-27 18:32 – Updated: 2026-06-30 03:35Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.
{
"affected": [],
"aliases": [
"CVE-2026-24869"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T16:16:36Z",
"severity": "HIGH"
},
"details": "Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox \u003c 147.0.2.",
"id": "GHSA-5hpc-pqrr-8j6m",
"modified": "2026-06-30T03:35:30Z",
"published": "2026-01-27T18:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24869"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-24869"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2008698"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433424"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24869.json"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-06"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5HQR-VX33-MFMH
Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
{
"affected": [],
"aliases": [
"CVE-2020-28018"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-06T13:15:00Z",
"severity": "CRITICAL"
},
"details": "Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.",
"id": "GHSA-5hqr-vx33-mfmh",
"modified": "2022-05-24T19:01:39Z",
"published": "2022-05-24T19:01:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28018"
},
{
"type": "WEB",
"url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28018-OCORK.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/11/14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/11/15"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/11/17"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/11/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/11/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/12/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/12/3"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5HR7-VH78-QH58
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-16 18:31NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
{
"affected": [],
"aliases": [
"CVE-2022-1097"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "MODERATE"
},
"details": "\u003ccode\u003eNSSToken\u003c/code\u003e objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8.",
"id": "GHSA-5hr7-vh78-qh58",
"modified": "2025-04-16T18:31:35Z",
"published": "2022-12-22T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1097"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745667"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-13"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-14"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-15"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HRV-4R6H-JGXC
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-16 18:31Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
{
"affected": [],
"aliases": [
"CVE-2022-22740"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "HIGH"
},
"details": "Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 91.5, Firefox \u003c 96, and Thunderbird \u003c 91.5.",
"id": "GHSA-5hrv-4r6h-jgxc",
"modified": "2025-04-16T18:31:36Z",
"published": "2022-12-22T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22740"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742334"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-01"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-02"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5HVG-WJM2-J333
Vulnerability from github – Published: 2026-07-27 18:31 – Updated: 2026-07-28 15:32SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.
{
"affected": [],
"aliases": [
"CVE-2026-51296"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T16:17:38Z",
"severity": "HIGH"
},
"details": "SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.",
"id": "GHSA-5hvg-wjm2-j333",
"modified": "2026-07-28T15:32:10Z",
"published": "2026-07-27T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51296"
},
{
"type": "WEB",
"url": "https://github.com/programmervuln/cveadvisory-/commit/75a435c839a4bcc6ca2ad21e3b07c978d814acb2"
},
{
"type": "WEB",
"url": "https://github.com/sqlite/sqlite/blob/master/src/json.c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.