cve.bz

CWE-415: Double Free, page 5

Filter

The product calls free() twice on the same memory address.

What the weakness is: CWE-415 at MITRE

Ask an AI about CWE-415

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-415: Double Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/415.html and https://cve.bz/cve/cwe/415?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-31745EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: reset: gpio: fix double free in reset_add_gpio_aux_device() error path When __auxiliary_device_add() fails, reset_add_gpio_aux_device() calls auxiliary_device_uninit(ade…

  2. 7.8CVE-2026-31730EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_process() may free cctx->remote_heap on the err_map path but does not clear the point…

  3. 7.8CVE-2026-31787EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on…

  4. 7.5CVE-2026-5657EPSS 0.2%

    iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

  5. 7.8CVE-2026-31686EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: mm/kasan: fix double free for kasan pXds kasan_free_pxd() assumes the page table is always struct page aligned. But that's not always the case for all architectures. E…

  6. 9.8CVE-2026-31609EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it a…

  7. 9.8CVE-2026-31608EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we …

  8. 7.8CVE-2026-31507EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pi…

  9. 7.8CVE-2026-31506EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix double free of WoL irq We do not need to free wol_irq since it was instantiated with devm_request_irq(). So devres will free for us.

  10. 7.8CVE-2026-31489EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: spi: meson-spicc: Fix double-put in remove path meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controlle…

  11. 7.8CVE-2026-31475EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded(). However, th…

  12. 7.8CVE-2026-31471EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_data before allocating the reorder window. If that allocation fails, the code fr…

  13. 7.8CVE-2026-31468EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Fix double free in dma-buf feature The error path through vfio_pci_core_feature_dma_buf() ignores its own advice to only use dma_buf_put() after dma_buf_export…

  14. 5.1CVE-2026-6654EPSS 0.2%

    Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

  15. 9.8CVE-2026-33824KEVEPSS 77%

    Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

  16. 7.0CVE-2026-32219EPSS 0.2%

    Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-32074EPSS 0.3%

    Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  18. 7.8CVE-2026-32069EPSS 0.3%

    Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  19. 7.8CVE-2026-26179EPSS 0.4%

    Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2026-26166EPSS 0.2%

    Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

  21. 7.8CVE-2026-26163EPSS 0.3%

    Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  22. 5.6CVE-2026-34867EPSS 0.09%

    Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability.

  23. 6.2CVE-2026-31053EPSS 0.1%

    A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially…

  24. 7.8CVE-2026-23449EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racin…

  25. 7.8CVE-2026-23408EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contain…

  26. 1.9CVE-2026-5186EPSS 0.1%

    A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local…

  27. 5.3CVE-2026-33995EPSS 0.3%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerber…

  28. 7.8CVE-2026-23387EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() devm_add_action_or_reset() already invokes the action on failure, so the explicit put causes a double-put.

  29. 6.1CVE-2026-4358EPSS 0.4%

    A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to di…

  30. 5.1CVE-2026-23868EPSS 0.2%

    Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.

  31. 7.5CVE-2025-69650EPSS 0.6%

    GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocat…

  32. 5.5CVE-2026-28537EPSS 0.08%

    Double free vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.

  33. 7.8CVE-2025-71238EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353…

  34. 5.0CVE-2025-61145EPSS 0.2%

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

  35. 5.5CVE-2025-12343EPSS 0.2%

    A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This…

  36. 7.8CVE-2026-23162EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm).…

  37. 5.9CVE-2026-25556EPSS 0.5%

    MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly dr…

  38. 7.8CVE-2026-23098EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh-…

  39. 7.8CVE-2026-23068EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: spi: spi-sprd-adi: Fix double free in probe error path The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_con…

  40. 5.5CVE-2026-20415EPSS 0.06%

    In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID:…

  41. 6.5CVE-2025-57785EPSS 0.4%

    A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

  42. 8.7CVE-2026-21918EPSS 0.4%

    A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, w…

  43. 8.4CVE-2025-13844EPSS 0.2%

    CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

  44. 7.8CVE-2025-68968EPSS 0.10%

    Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect the input function.

  45. 7.8CVE-2026-20867EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  46. 7.0CVE-2026-20863EPSS 0.4%

    Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-20861EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-20832EPSS 0.5%

    Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability

  49. 6.4CVE-2025-68657EPSS 0.2%

    Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_…

  50. 5.8CVE-2026-20026EPSS 0.7%

    Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resu…