cve.bz

CWE-416: Use After Free, page 34

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-63802EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg'…

  2. 8.8CVE-2026-63801EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a refe…

  3. 9.8CVE-2026-63800EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). I…

  4. 8.4CVE-2026-63797EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_ch…

  5. 10.0CVE-2026-63795EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after…

  6. 7.8CVE-2026-63793EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol->volume_label with a mutex and snaphost the label before copy_to_user. This prevent a use-after-free when FS_IOC_SETFSL…

  7. 7.8CVE-2026-53401EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry po…

  8. 9.8CVE-2026-53399EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd…

  9. 7.8CVE-2026-53389EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the syn…

  10. 7.8CVE-2026-53388EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_c…

  11. 9.8CVE-2026-53384EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device…

  12. 7.8CVE-2026-53381EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting…

  13. 7.0CVE-2026-58598EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

  14. 7.8CVE-2026-57076EPSS 0.2%

    YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor…

  15. 6.2CVE-2026-13713EPSS 0.2%

    YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and …

  16. 5.9CVE-2026-55406EPSS 0.2%

    Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor…

  17. 6.7CVE-2026-6424EPSS 0.2%

    Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system

  18. 4.9CVE-2026-38753EPSS 0.1%

    A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

  19. 8.3CVE-2026-56434EPSS 0.5%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configurati…

  20. 6.3CVE-2026-61860EPSS 0.4%

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during ima…

  21. 7.5CVE-2026-15777EPSS 0.3%

    Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security seve…

  22. 8.3CVE-2026-15774EPSS 0.3%

    Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  23. 9.6CVE-2026-15773EPSS 0.3%

    Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  24. 8.3CVE-2026-15772EPSS 0.3%

    Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  25. 7.5CVE-2026-15765EPSS 0.3%

    Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: …

  26. 7.5CVE-2026-15764EPSS 0.3%

    Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security s…

  27. 7.0CVE-2026-58637EPSS 0.3%

    Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

  28. 7.8CVE-2026-58634EPSS 0.3%

    Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2026-58633EPSS 0.3%

    Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  30. 7.8CVE-2026-58632EPSS 0.3%

    Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

  31. 7.0CVE-2026-58629EPSS 0.3%

    Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

  32. 8.8CVE-2026-58626EPSS 0.9%

    Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

  33. 7.0CVE-2026-58619EPSS 0.3%

    Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

  34. 7.8CVE-2026-58613EPSS 0.4%

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  35. 7.0CVE-2026-58544EPSS 0.3%

    Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

  36. 6.3CVE-2026-58543EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack.

  37. 7.8CVE-2026-58537EPSS 0.3%

    Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.

  38. 7.8CVE-2026-58536EPSS 0.3%

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  39. 7.5CVE-2026-58531EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network.

  40. 7.8CVE-2026-57093EPSS 0.3%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  41. 9.9CVE-2026-57092EPSS 0.9%

    Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

  42. 9.8CVE-2026-57089EPSS 0.7%

    Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.

  43. 8.1CVE-2026-56649EPSS 0.7%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.

  44. 7.5CVE-2026-56648EPSS 0.5%

    Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.

  45. 7.8CVE-2026-56644EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-56643EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-56187EPSS 0.3%

    Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  48. 7.0CVE-2026-56183EPSS 0.3%

    Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  49. 7.0CVE-2026-56173EPSS 0.3%

    Use after free in Windows WebView allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-55128EPSS 0.6%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.