CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11157 vulnerabilities reference this CWE, most recent first.
GHSA-V3G4-HC2R-5HFP
Vulnerability from github – Published: 2023-08-03 15:30 – Updated: 2024-04-04 06:31Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.
{
"affected": [],
"aliases": [
"CVE-2023-22317"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T13:15:09Z",
"severity": "HIGH"
},
"details": "Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.",
"id": "GHSA-v3g4-hc2r-5hfp",
"modified": "2024-04-04T06:31:27Z",
"published": "2023-08-03T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22317"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU92877622"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-356-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3H2-5553-43PV
Vulnerability from github – Published: 2022-05-14 01:34 – Updated: 2022-05-14 01:34In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Use-after-free issue in heap while loading audio effects config in audio effects factory.
{
"affected": [],
"aliases": [
"CVE-2018-11962"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-11T15:29:00Z",
"severity": "HIGH"
},
"details": "In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Use-after-free issue in heap while loading audio effects config in audio effects factory.",
"id": "GHSA-v3h2-5553-43pv",
"modified": "2022-05-14T01:34:57Z",
"published": "2022-05-14T01:34:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11962"
},
{
"type": "WEB",
"url": "https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletin"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106496"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3J6-XF77-8R9C
Vulnerability from github – Published: 2021-08-25 20:49 – Updated: 2021-08-19 20:51An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "actix-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-35901"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T20:51:41Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.",
"id": "GHSA-v3j6-xf77-8r9c",
"modified": "2021-08-19T20:51:41Z",
"published": "2021-08-25T20:49:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35901"
},
{
"type": "WEB",
"url": "https://github.com/actix/actix-web/issues/1321"
},
{
"type": "PACKAGE",
"url": "https://github.com/actix/actix-web"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0048.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Use-after-free in actix-http"
}
GHSA-V3J8-73VP-J87V
Vulnerability from github – Published: 2024-08-05 15:30 – Updated: 2024-08-05 15:30Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
{
"affected": [],
"aliases": [
"CVE-2024-23384"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-05T15:15:48Z",
"severity": "HIGH"
},
"details": "Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.",
"id": "GHSA-v3j8-73vp-j87v",
"modified": "2024-08-05T15:30:53Z",
"published": "2024-08-05T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23384"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3MX-WGXP-826P
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-05-30 12:30In the Linux kernel, the following vulnerability has been resolved:
media: iris: fix use-after-free of fmt_src during MBPF check
During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct.
The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks.
{
"affected": [],
"aliases": [
"CVE-2026-46210"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:36Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: fix use-after-free of fmt_src during MBPF check\n\nDuring concurrency testing, multiple instances can run in parallel, and\neach instance uses its own inst-\u003elock while the core-\u003elock protects the\nlist of active instances. The race happens because these locks cover\ndifferent scopes, inst-\u003elock protects only the internals of a single\ninstance, while the Macro Blocks Per Frame (MBPF) checker walks the\ncore list under core-\u003elock and reads fields like fmt_src-\u003ewidth and\nfmt_src-\u003eheight. At the same time, iris_close() may free fmt_src and\nfmt_dst under inst-\u003elock while the instance is still present in the core\nlist. This allows a situation where the MBPF checker, still iterating\nthrough the core list, reaches an instance whose fmt_src was already\nfreed by another thread and ends up dereferencing a dangling pointer,\nresulting in a use-after-free. This happens because the MBPF checker\nassumes that any instance in the core list is fully valid, but the\nfreeing of fmt_src and fmt_dst without removing the instance from the\ncore list is not correct.\n\nThe correct ordering is to defer freeing fmt_src and fmt_dst until after\nthe instance has been removed from the core list and all teardown under\nthe core lock has completed, ensuring that no dangling pointers are ever\nexposed during MBPF checks.",
"id": "GHSA-v3mx-wgxp-826p",
"modified": "2026-05-30T12:30:26Z",
"published": "2026-05-28T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46210"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d9593ad1a58c5acc3e5fa2a48222bb7632e6812"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/494ffd1712a588e590e6b1e9f876a8c8b24a9180"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3PH-2FF8-MH78
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Form count property. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6477.
{
"affected": [],
"aliases": [
"CVE-2018-17640"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-24T04:29:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Form count property. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6477.",
"id": "GHSA-v3ph-2ff8-mh78",
"modified": "2022-05-13T01:33:58Z",
"published": "2022-05-13T01:33:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17640"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-1217"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3W9-GMRF-H26R
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02Windows Graphics Component Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31188.
{
"affected": [],
"aliases": [
"CVE-2021-31170"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-11T19:15:00Z",
"severity": "HIGH"
},
"details": "Windows Graphics Component Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31188.",
"id": "GHSA-v3w9-gmrf-h26r",
"modified": "2022-05-24T19:02:03Z",
"published": "2022-05-24T19:02:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31170"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31170"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-578"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3WV-42WV-GH55
Vulnerability from github – Published: 2023-05-18 00:30 – Updated: 2024-04-04 04:14A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.
{
"affected": [],
"aliases": [
"CVE-2023-1859"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-17T23:15:09Z",
"severity": "MODERATE"
},
"details": "A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.",
"id": "GHSA-v3wv-42wv-gh55",
"modified": "2024-04-04T04:14:03Z",
"published": "2023-05-18T00:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1859"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/20230313090002.3308025-1-zyytlz.wz%40163.com"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/20230313090002.3308025-1-zyytlz.wz@163.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V422-67VR-JRJ5
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:50Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.
{
"affected": [],
"aliases": [
"CVE-2017-14201"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-29T01:15:00Z",
"severity": "HIGH"
},
"details": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.",
"id": "GHSA-v422-67vr-jrj5",
"modified": "2024-04-04T01:50:20Z",
"published": "2022-05-24T16:55:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14201"
},
{
"type": "WEB",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
},
{
"type": "WEB",
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"type": "WEB",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V42H-9GP8-3HFQ
Vulnerability from github – Published: 2022-05-14 03:56 – Updated: 2025-04-12 13:02ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.
{
"affected": [],
"aliases": [
"CVE-2016-6290"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-07-25T14:59:00Z",
"severity": "CRITICAL"
},
"details": "ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.",
"id": "GHSA-v42h-9gp8-3hfq",
"modified": "2025-04-12T13:02:53Z",
"published": "2022-05-14T03:56:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6290"
},
{
"type": "WEB",
"url": "https://bugs.php.net/72562"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201611-22"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207170"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=3798eb6fd5dddb211b01d41495072fd9858d4e32"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git;a=commit;h=3798eb6fd5dddb211b01d41495072fd9858d4e32"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2016/07/24/2"
},
{
"type": "WEB",
"url": "http://php.net/ChangeLog-5.php"
},
{
"type": "WEB",
"url": "http://php.net/ChangeLog-7.php"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3631"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92097"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.