CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11157 vulnerabilities reference this CWE, most recent first.
GHSA-GCX2-XQVG-96FR
Vulnerability from github – Published: 2022-05-14 02:34 – Updated: 2022-05-14 02:34Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2013-1312"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-05-15T03:36:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka \"Internet Explorer Use After Free Vulnerability.\"",
"id": "GHSA-gcx2-xqvg-96fr",
"modified": "2022-05-14T02:34:43Z",
"published": "2022-05-14T02:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1312"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16328"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/ncas/alerts/TA13-134A"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GCX8-MFF3-89CC
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In Pixel's use of the Catpipe library, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150730508
{
"affected": [],
"aliases": [
"CVE-2020-0434"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-17T19:15:00Z",
"severity": "HIGH"
},
"details": "In Pixel\u0027s use of the Catpipe library, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150730508",
"id": "GHSA-gcx8-mff3-89cc",
"modified": "2022-05-24T17:28:50Z",
"published": "2022-05-24T17:28:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0434"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2020-09-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GCXV-GV82-5HP5
Vulnerability from github – Published: 2026-09-15 15:32 – Updated: 2026-09-20 03:30Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
{
"affected": [],
"aliases": [
"CVE-2026-92022"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T13:16:52Z",
"severity": "HIGH"
},
"details": "Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.",
"id": "GHSA-gcxv-gv82-5hp5",
"modified": "2026-09-20T03:30:23Z",
"published": "2026-09-15T15:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92022"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068059"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-90"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-91"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-92"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-93"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-94"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-95"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-96"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF62-M3Q5-X45G
Vulnerability from github – Published: 2024-03-06 21:31 – Updated: 2024-08-09 00:31Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2024-2176"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-06T19:15:09Z",
"severity": "HIGH"
},
"details": "Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-gf62-m3q5-x45g",
"modified": "2024-08-09T00:31:19Z",
"published": "2024-03-06T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2176"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/325936438"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF6H-99M8-MC2M
Vulnerability from github – Published: 2022-05-14 00:52 – Updated: 2022-05-14 00:52Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
{
"affected": [],
"aliases": [
"CVE-2018-16036"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-18T17:29:00Z",
"severity": "CRITICAL"
},
"details": "Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.",
"id": "GHSA-gf6h-99m8-mc2m",
"modified": "2022-05-14T00:52:30Z",
"published": "2022-05-14T00:52:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16036"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb18-41.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106164"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF6P-HMWH-GPC7
Vulnerability from github – Published: 2024-04-10 21:30 – Updated: 2025-01-07 18:30In the Linux kernel, the following vulnerability has been resolved:
drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.
This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."
{
"affected": [],
"aliases": [
"CVE-2021-47200"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T19:15:48Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\n\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\nthe gem object\u0027s refcount == 1 on entry to drm_gem_prime_mmap(), that\ndrop will free the gem object, and the subsequent drm_gem_object_get()\nwill be a UAF. Fix by grabbing a reference before calling the mmap\nhelper.\n\nThis issue was forseen when the reference dropping was adding in\ncommit 9786b65bc61ac (\"drm/ttm: fix mmap refcounting\"):\n \"For that to work properly the drm_gem_object_get() call in\n drm_gem_ttm_mmap() must be moved so it happens before calling\n obj-\u003efuncs-\u003emmap(), otherwise the gem refcount would go down\n to zero.\"",
"id": "GHSA-gf6p-hmwh-gpc7",
"modified": "2025-01-07T18:30:41Z",
"published": "2024-04-10T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47200"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF77-WGV9-4V74
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2026-08-04 12:33In the Linux kernel, the following vulnerability has been resolved:
crypto: rk3288 - Fix use after free in unprepare
The unprepare call must be carried out before the finalize call as the latter can free the request.
{
"affected": [],
"aliases": [
"CVE-2024-35792"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T13:15:58Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: rk3288 - Fix use after free in unprepare\n\nThe unprepare call must be carried out before the finalize call\nas the latter can free the request.",
"id": "GHSA-gf77-wgv9-4v74",
"modified": "2026-08-04T12:33:04Z",
"published": "2024-05-17T15:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35792"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48dd260fdb728eda4a246f635d1325e82f0d3555"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c0afb6b88fbbc177fa322a835f874be217bffe45"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eb2a41a8ae8c8c4f68aef3bd94665c0cf23e04be"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF7H-6C87-92XW
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2025-59210"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:16:01Z",
"severity": "HIGH"
},
"details": "Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability",
"id": "GHSA-gf7h-6c87-92xw",
"modified": "2025-10-14T18:30:34Z",
"published": "2025-10-14T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59210"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59210"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF8X-6JH7-3MJV
Vulnerability from github – Published: 2025-02-25 18:31 – Updated: 2026-04-06 15:31A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.
{
"affected": [],
"aliases": [
"CVE-2025-26601"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-25T16:15:39Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.",
"id": "GHSA-gf8x-6jh7-3mjv",
"modified": "2026-04-06T15:31:20Z",
"published": "2025-02-25T18:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26601"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250516-0004"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345251"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-26601"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7458"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7165"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7163"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3976"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2880"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2879"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2875"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2873"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2865"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2862"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2861"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2502"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2500"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF8X-C888-36H7
Vulnerability from github – Published: 2024-01-02 06:30 – Updated: 2024-01-02 06:30Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
{
"affected": [],
"aliases": [
"CVE-2023-33117"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-02T06:15:12Z",
"severity": "HIGH"
},
"details": "Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.",
"id": "GHSA-gf8x-c888-36h7",
"modified": "2024-01-02T06:30:31Z",
"published": "2024-01-02T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33117"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.