CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2021-1958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-09T08:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables",
  "id": "GHSA-j6hv-997g-w46w",
  "modified": "2022-06-29T00:00:40Z",
  "published": "2022-05-24T19:14:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1958"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-6979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-10-13T19:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6988, and CVE-2016-6993.",
  "id": "GHSA-j6j4-x47h-j5xv",
  "modified": "2022-05-17T02:21:10Z",
  "published": "2022-05-17T02:21:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6979"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb16-33.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/93491"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1036986"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-16038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-08T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-j6j9-67jq-2hgx",
  "modified": "2022-05-24T17:38:18Z",
  "published": "2022-05-24T17:38:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16038"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1138683"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-38378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T13:15:26Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe\n\nIn probe appletb_kbd_probe() a \"struct appletb_kbd *kbd\" is allocated\nvia devm_kzalloc() to store touch bar keyboard related data.\nLater on if backlight_device_get_by_name() finds a backlight device\nwith name \"appletb_backlight\" a timer (kbd-\u003einactivity_timer) is setup\nwith appletb_inactivity_timer() and the timer is armed to run after\nappletb_tb_dim_timeout (60) seconds.\n\nA use-after-free is triggered when failure occurs after the timer is\narmed. This ultimately means probe failure occurs and as a result the\n\"struct appletb_kbd *kbd\" which is device managed memory is freed.\nAfter 60 seconds the timer will have expired and __run_timers will\nattempt to access the timer (kbd-\u003einactivity_timer) however the kdb\nstructure has been freed causing a use-after free.\n\n[   71.636938] ==================================================================\n[   71.637915] BUG: KASAN: slab-use-after-free in __run_timers+0x7ad/0x890\n[   71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0\n[   71.637915]\n[   71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary)\n[   71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[   71.637915] Call Trace:\n[   71.637915]  \u003cIRQ\u003e\n[   71.637915]  dump_stack_lvl+0x53/0x70\n[   71.637915]  print_report+0xce/0x670\n[   71.637915]  ? __run_timers+0x7ad/0x890\n[   71.637915]  kasan_report+0xce/0x100\n[   71.637915]  ? __run_timers+0x7ad/0x890\n[   71.637915]  __run_timers+0x7ad/0x890\n[   71.637915]  ? __pfx___run_timers+0x10/0x10\n[   71.637915]  ? update_process_times+0xfc/0x190\n[   71.637915]  ? __pfx_update_process_times+0x10/0x10\n[   71.637915]  ? _raw_spin_lock_irq+0x80/0xe0\n[   71.637915]  ? _raw_spin_lock_irq+0x80/0xe0\n[   71.637915]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[   71.637915]  run_timer_softirq+0x141/0x240\n[   71.637915]  ? __pfx_run_timer_softirq+0x10/0x10\n[   71.637915]  ? __pfx___hrtimer_run_queues+0x10/0x10\n[   71.637915]  ? kvm_clock_get_cycles+0x18/0x30\n[   71.637915]  ? ktime_get+0x60/0x140\n[   71.637915]  handle_softirqs+0x1b8/0x5c0\n[   71.637915]  ? __pfx_handle_softirqs+0x10/0x10\n[   71.637915]  irq_exit_rcu+0xaf/0xe0\n[   71.637915]  sysvec_apic_timer_interrupt+0x6c/0x80\n[   71.637915]  \u003c/IRQ\u003e\n[   71.637915]\n[   71.637915] Allocated by task 39:\n[   71.637915]  kasan_save_stack+0x33/0x60\n[   71.637915]  kasan_save_track+0x14/0x30\n[   71.637915]  __kasan_kmalloc+0x8f/0xa0\n[   71.637915]  __kmalloc_node_track_caller_noprof+0x195/0x420\n[   71.637915]  devm_kmalloc+0x74/0x1e0\n[   71.637915]  appletb_kbd_probe+0x37/0x3c0\n[   71.637915]  hid_device_probe+0x2d1/0x680\n[   71.637915]  really_probe+0x1c3/0x690\n[   71.637915]  __driver_probe_device+0x247/0x300\n[   71.637915]  driver_probe_device+0x49/0x210\n[...]\n[   71.637915]\n[   71.637915] Freed by task 39:\n[   71.637915]  kasan_save_stack+0x33/0x60\n[   71.637915]  kasan_save_track+0x14/0x30\n[   71.637915]  kasan_save_free_info+0x3b/0x60\n[   71.637915]  __kasan_slab_free+0x37/0x50\n[   71.637915]  kfree+0xcf/0x360\n[   71.637915]  devres_release_group+0x1f8/0x3c0\n[   71.637915]  hid_device_probe+0x315/0x680\n[   71.637915]  really_probe+0x1c3/0x690\n[   71.637915]  __driver_probe_device+0x247/0x300\n[   71.637915]  driver_probe_device+0x49/0x210\n[...]\n\nThe root cause of the issue is that the timer is not disarmed\non failure paths leading to it remaining active and accessing\nfreed memory. To fix this call timer_delete_sync() to deactivate\nthe timer.\n\nAnother small issue is that timer_delete_sync is called\nunconditionally in appletb_kbd_remove(), fix this by checking\nfor a valid kbd-\u003ebacklight_dev before calling timer_delete_sync.",
  "id": "GHSA-j6m8-x4v6-3fgh",
  "modified": "2025-11-19T21:31:16Z",
  "published": "2025-07-25T15:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38378"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/38224c472a038fa9ccd4085511dd9f3d6119dbf9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51720dee3a61ebace36c3dcdd0b4a488e0970f29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-0310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-11T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android ID: A-170212632.",
  "id": "GHSA-j6q6-gjjx-g2w9",
  "modified": "2022-05-24T17:38:41Z",
  "published": "2022-05-24T17:38:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0310"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2021-01-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-04T16:15:35Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.",
  "id": "GHSA-j6q9-g64f-w437",
  "modified": "2025-06-04T21:31:14Z",
  "published": "2025-06-04T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23106"
    },
    {
      "type": "WEB",
      "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates"
    },
    {
      "type": "WEB",
      "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23106"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:04:40Z",
    "severity": "HIGH"
  },
  "details": "Windows Remote Desktop Services Remote Code Execution Vulnerability",
  "id": "GHSA-j6r2-q88x-5m39",
  "modified": "2024-12-12T03:33:05Z",
  "published": "2024-12-12T03:33:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49132"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49132"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-12-20T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the author attribute of Circle Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5023.",
  "id": "GHSA-j6v5-287m-5xw7",
  "modified": "2022-05-13T01:37:36Z",
  "published": "2022-05-13T01:37:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14831"
    },
    {
      "type": "WEB",
      "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
    },
    {
      "type": "WEB",
      "url": "https://zerodayinitiative.com/advisories/ZDI-17-875"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-11T13:15:50Z",
    "severity": "HIGH"
  },
  "details": "An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox \u003c 127.",
  "id": "GHSA-j6vm-3wj6-fwrh",
  "modified": "2024-09-12T18:31:38Z",
  "published": "2024-06-11T15:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5694"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1895055"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-2049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-08T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9 Android ID: A-120445479",
  "id": "GHSA-j72g-737f-7x6r",
  "modified": "2022-05-24T16:45:21Z",
  "published": "2022-05-24T16:45:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2049"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2019-05-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}