CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11157 vulnerabilities reference this CWE, most recent first.
GHSA-PRRG-PVXW-Q4M2
Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-16 21:30In the Linux kernel, the following vulnerability has been resolved:
HID: mcp-2221: prevent UAF in delayed work
If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work.
Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself.
{
"affected": [],
"aliases": [
"CVE-2023-53459"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T12:15:47Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: mcp-2221: prevent UAF in delayed work\n\nIf the device is plugged/unplugged without giving time for mcp_init_work()\nto complete, we might kick in the devm free code path and thus have\nunavailable struct mcp_2221 while in delayed work.\n\nCanceling the delayed_work item is enough to solve the issue, because\ncancel_delayed_work_sync will prevent the work item to requeue itself.",
"id": "GHSA-prrg-pvxw-q4m2",
"modified": "2026-01-16T21:30:29Z",
"published": "2025-10-01T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53459"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/47e91fdfa511139f2549687edb0d8649b123227b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5dc297652dbc557eba7ca7d6a4c5f1940dffffb1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PRV7-W76C-77W5
Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-106211"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T19:17:47Z",
"severity": "CRITICAL"
},
"details": "Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-prv7-w76c-77w5",
"modified": "2026-10-06T21:31:42Z",
"published": "2026-10-06T21:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106211"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/562002095"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PRXC-P2G7-M92V
Vulnerability from github – Published: 2025-03-31 21:32 – Updated: 2025-03-31 21:32In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
{
"affected": [],
"aliases": [
"CVE-2025-21893"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T20:15:14Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Fix UAF in key_put()\n\nOnce a key\u0027s reference count has been reduced to 0, the garbage collector\nthread may destroy it at any time and so key_put() is not allowed to touch\nthe key after that point. The most key_put() is normally allowed to do is\nto touch key_gc_work as that\u0027s a static global variable.\n\nHowever, in an effort to speed up the reclamation of quota, this is now\ndone in key_put() once the key\u0027s usage is reduced to 0 - but now the code\nis looking at the key after the deadline, which is forbidden.\n\nFix this by using a flag to indicate that a key can be gc\u0027d now rather than\nlooking at the key\u0027s refcount in the garbage collector.",
"id": "GHSA-prxc-p2g7-m92v",
"modified": "2025-03-31T21:32:48Z",
"published": "2025-03-31T21:32:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21893"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6afe2ea2daec156bd94ad2c5a6f4f4c48240dcd3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75845c6c1a64483e9985302793dbf0dfa5f71e32"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f6a3cf833188e897c97028cd7b926e3f2cb1a8c0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PRXH-339C-HVMR
Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-26 18:31Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: Low)
{
"affected": [],
"aliases": [
"CVE-2026-79119"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T21:18:06Z",
"severity": "HIGH"
},
"details": "Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: Low)",
"id": "GHSA-prxh-339c-hvmr",
"modified": "2026-08-26T18:31:43Z",
"published": "2026-08-25T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79119"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/513688690"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PV4C-F5CP-HCVH
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2020-15997"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-03T03:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.",
"id": "GHSA-pv4c-f5cp-hcvh",
"modified": "2022-05-24T17:32:56Z",
"published": "2022-05-24T17:32:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15997"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1133668"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PV5C-VXPF-5J93
Vulnerability from github – Published: 2025-10-09 06:30 – Updated: 2025-10-09 06:30Memory corruption while allocating buffers in DSP service.
{
"affected": [],
"aliases": [
"CVE-2025-47354"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-09T04:16:47Z",
"severity": "HIGH"
},
"details": "Memory corruption while allocating buffers in DSP service.",
"id": "GHSA-pv5c-vxpf-5j93",
"modified": "2025-10-09T06:30:25Z",
"published": "2025-10-09T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47354"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PV5P-66R3-9FQ9
Vulnerability from github – Published: 2026-08-11 21:33 – Updated: 2026-08-11 21:33An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
{
"affected": [],
"aliases": [
"CVE-2026-18706"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T19:17:25Z",
"severity": "HIGH"
},
"details": "An issue in MongoDB Server\u0027s $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.",
"id": "GHSA-pv5p-66r3-9fq9",
"modified": "2026-08-11T21:33:08Z",
"published": "2026-08-11T21:33:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18706"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-128551"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PV6W-73JG-C3FQ
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2012-4216"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-11-21T12:55:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.",
"id": "GHSA-pv6w-73jg-c3fq",
"modified": "2022-05-13T01:23:40Z",
"published": "2022-05-13T01:23:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4216"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=798853"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80189"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16902"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/87609"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2012-1482.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2012-1483.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51359"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51360"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51369"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51370"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51381"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51434"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51439"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51440"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2583"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2584"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2588"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:173"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2012/mfsa2012-105.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/56634"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1636-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1638-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1638-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1638-3"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PV7W-XVFQ-976M
Vulnerability from github – Published: 2022-05-24 17:04 – Updated: 2022-05-24 17:04Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
{
"affected": [],
"aliases": [
"CVE-2019-16459"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-19T15:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .",
"id": "GHSA-pv7w-xvfq-976m",
"modified": "2022-05-24T17:04:43Z",
"published": "2022-05-24T17:04:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16459"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb19-55.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PV86-XGR9-75FJ
Vulnerability from github – Published: 2022-03-27 00:00 – Updated: 2022-04-01 00:00User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
{
"affected": [],
"aliases": [
"CVE-2022-1071"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-26T04:15:00Z",
"severity": "HIGH"
},
"details": "User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.",
"id": "GHSA-pv86-xgr9-75fj",
"modified": "2022-04-01T00:00:50Z",
"published": "2022-03-27T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1071"
},
{
"type": "WEB",
"url": "https://github.com/mruby/mruby/commit/aaa28a508903041dd7399d4159a8ace9766b022f"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/6597ece9-07af-415b-809b-919ce0a17cf3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.