CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11157 vulnerabilities reference this CWE, most recent first.
GHSA-F4RQ-9JJ2-8FX8
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the currentPage property of a Host object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6519.
{
"affected": [],
"aliases": [
"CVE-2018-17665"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-24T04:29:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the currentPage property of a Host object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6519.",
"id": "GHSA-f4rq-9jj2-8fx8",
"modified": "2022-05-13T01:33:55Z",
"published": "2022-05-13T01:33:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17665"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-1178"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4RX-6CWC-QGFM
Vulnerability from github – Published: 2022-09-20 00:00 – Updated: 2022-09-22 00:00A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
{
"affected": [],
"aliases": [
"CVE-2022-3239"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-19T20:15:00Z",
"severity": "HIGH"
},
"details": "A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",
"id": "GHSA-f4rx-6cwc-qgfm",
"modified": "2022-09-22T00:00:26Z",
"published": "2022-09-20T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3239"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c08eadca1bdfa099e20a32f8fa4b52b2f672236d"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230214-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4V9-6PHP-999P
Vulnerability from github – Published: 2022-07-19 00:00 – Updated: 2022-07-24 00:00This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16643.
{
"affected": [],
"aliases": [
"CVE-2022-28676"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-18T19:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16643.",
"id": "GHSA-f4v9-6php-999p",
"modified": "2022-07-24T00:00:36Z",
"published": "2022-07-19T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28676"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-767"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4VW-9R7R-C4GH
Vulnerability from github – Published: 2022-05-14 03:56 – Updated: 2022-05-14 03:56WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls.
{
"affected": [],
"aliases": [
"CVE-2016-5170"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-25T20:59:00Z",
"severity": "HIGH"
},
"details": "WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls.",
"id": "GHSA-f4vw-9r7r-c4gh",
"modified": "2022-05-14T03:56:53Z",
"published": "2022-05-14T03:56:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5170"
},
{
"type": "WEB",
"url": "https://codereview.chromium.org/2332003002"
},
{
"type": "WEB",
"url": "https://crbug.com/641101"
},
{
"type": "WEB",
"url": "https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201610-09"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1905.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3667"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92942"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036826"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4W3-FH2Q-326P
Vulnerability from github – Published: 2022-05-02 06:11 – Updated: 2024-02-03 03:30Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.
{
"affected": [],
"aliases": [
"CVE-2010-0302"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-05T19:30:00Z",
"severity": "MODERATE"
},
"details": "Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.",
"id": "GHSA-f4w3-fh2q-326p",
"modified": "2024-02-03T03:30:26Z",
"published": "2022-05-02T06:11:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0302"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=557775"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11216"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2010-0129.html"
},
{
"type": "WEB",
"url": "http://cups.org/articles.php?L596"
},
{
"type": "WEB",
"url": "http://cups.org/str.php?L3490"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037174.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38785"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38927"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38979"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40220"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201207-10.xml"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4188"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:073"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38510"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1024124"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-906-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1481"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F53R-MW9W-8P2C
Vulnerability from github – Published: 2024-09-27 15:30 – Updated: 2024-10-02 15:30In the Linux kernel, the following vulnerability has been resolved:
net: microchip: vcap: Fix use-after-free error in kunit test
This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule.
{
"affected": [],
"aliases": [
"CVE-2024-46831"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-27T13:15:15Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: microchip: vcap: Fix use-after-free error in kunit test\n\nThis is a clear use-after-free error. We remove it, and rely on checking\nthe return code of vcap_del_rule.",
"id": "GHSA-f53r-mw9w-8p2c",
"modified": "2024-10-02T15:30:37Z",
"published": "2024-09-27T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46831"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a3c1e45156ad39f225cd7ddae0f81230a3b1e657"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b0804c286ccfcf5f5c004d5bf8a54c0508b5e86b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f7fe95f40c85311c98913fe6ae2c56adb7f767a7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F55C-C9JM-8544
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-01-20 00:02In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200251074References: N/A
{
"affected": [],
"aliases": [
"CVE-2021-39681"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200251074References: N/A",
"id": "GHSA-f55c-c9jm-8544",
"modified": "2022-01-20T00:02:07Z",
"published": "2022-01-15T00:01:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39681"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2022-01-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F55P-FQH6-JJMF
Vulnerability from github – Published: 2025-04-07 12:33 – Updated: 2025-04-07 12:33Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
{
"affected": [],
"aliases": [
"CVE-2025-21437"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T11:15:52Z",
"severity": "HIGH"
},
"details": "Memory corruption while processing memory map or unmap IOCTL operations simultaneously.",
"id": "GHSA-f55p-fqh6-jjmf",
"modified": "2025-04-07T12:33:19Z",
"published": "2025-04-07T12:33:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21437"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F56G-CHQP-22M9
Vulnerability from github – Published: 2024-02-03 00:28 – Updated: 2026-01-22 22:36Overview
Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the Proplist object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it.
This advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought.
This impacts all versions of the crate before 2.5.0 back to 1.0.5. Before version 1.0.5 the function that produces the iterator was broken to the point of being useless.
Patches
Users are required to update to version 2.5.0 or newer.
Versions older than 2.5.0 have been yanked from crates.io as of the 22nd of October 2020.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "libpulse-binding"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.5"
},
{
"fixed": "2.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25001"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-03T00:28:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Overview\n\nVersion 2.5.0 of the `libpulse-binding` Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the `Proplist` object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it.\n\nThis advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought.\n\nThis impacts all versions of the crate before 2.5.0 back to 1.0.5. Before version 1.0.5 the function that produces the iterator was broken to the point of being useless.\n\n### Patches\n\nUsers are required to update to version 2.5.0 or newer.\n\nVersions older than 2.5.0 have been yanked from crates.io as of the 22nd of October 2020.",
"id": "GHSA-f56g-chqp-22m9",
"modified": "2026-01-22T22:36:03Z",
"published": "2024-02-03T00:28:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jnqnfe/pulse-binding-rust/security/advisories/GHSA-f56g-chqp-22m9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25001"
},
{
"type": "WEB",
"url": "https://github.com/jnqnfe/pulse-binding-rust/commit/9e31c82d71749619387cb9d0c9698134d05b28c9"
},
{
"type": "PACKAGE",
"url": "https://github.com/jnqnfe/pulse-binding-rust"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2018-0020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Use after free in libpulse-binding"
}
GHSA-F582-FQQF-2MGP
Vulnerability from github – Published: 2025-08-24 18:30 – Updated: 2025-08-24 18:30A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue.
{
"affected": [],
"aliases": [
"CVE-2025-9394"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-24T16:15:30Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue.",
"id": "GHSA-f582-fqqf-2mgp",
"modified": "2025-08-24T18:30:24Z",
"published": "2025-08-24T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9394"
},
{
"type": "WEB",
"url": "https://github.com/podofo/podofo/issues/275"
},
{
"type": "WEB",
"url": "https://github.com/podofo/podofo/commit/22d16cb142f293bf956f66a4d399cdd65576d36c"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1edJH17GAiK9R441Gjyj8tiV_2ptoL16U/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.321227"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.321227"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.632364"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.632365"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.