cve.bz

CWE-416: Use After Free, page 61

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-27277EPSS 0.2%

    Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  2. 7.8CVE-2026-27276EPSS 0.2%

    Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  3. 8.8CVE-2026-3847EPSS 0.3%

    Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Fi…

  4. 7.8CVE-2026-30978EPSS 0.3%

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulnerability is fixed in…

  5. 7.8CVE-2026-26134EPSS 0.4%

    Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-26132EPSS 2.1%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  7. 7.8CVE-2026-26107EPSS 0.5%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  8. 7.8CVE-2026-25189EPSS 0.3%

    Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  9. 7.0CVE-2026-25178EPSS 0.3%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  10. 7.0CVE-2026-25171EPSS 0.3%

    Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.

  11. 7.0CVE-2026-25170EPSS 0.3%

    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  12. 7.4CVE-2026-25167EPSS 0.3%

    Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

  13. 7.0CVE-2026-24295EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  14. 7.8CVE-2026-24292EPSS 0.4%

    Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

  15. 7.8CVE-2026-24289EPSS 4.6%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  16. 7.0CVE-2026-24285EPSS 0.5%

    Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-23671EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-23669EPSS 0.9%

    Use after free in RPC Runtime allows an authorized attacker to execute code over a network.

  19. 7.0CVE-2026-23667EPSS 0.3%

    Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.

  20. 5.3CVE-2026-28688EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice…

  21. 5.3CVE-2026-28687EPSS 0.3%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access …

  22. 8.7CVE-2026-28799EPSS 0.3%

    PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscrip…

  23. 7.1CVE-2025-13350EPSS 0.2%

    Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree…

  24. 5.3CVE-2026-22040EPSS 0.3%

    NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubs…

  25. 7.8CVE-2026-23234EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device u…

  26. 7.8CVE-2026-23231ExploitEPSS 1.0%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) b…

  27. 6.7CVE-2026-0027EPSS 0.1%

    In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

  28. 7.8CVE-2025-47386EPSS 0.08%

    Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

  29. 7.8CVE-2025-47381EPSS 0.08%

    Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

  30. 7.8CVE-2025-47379EPSS 0.08%

    Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

  31. 7.8CVE-2025-47377EPSS 0.08%

    Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

  32. 7.8CVE-2025-47376EPSS 0.08%

    Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

  33. 7.8CVE-2025-47375EPSS 0.08%

    Memory corruption while handling different IOCTL calls from the user-space simultaneously.

  34. 6.7CVE-2026-20443EPSS 0.09%

    In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patc…

  35. 4.4CVE-2026-20442EPSS 0.08%

    In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS1…

  36. 4.4CVE-2026-20439EPSS 0.08%

    In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10…

  37. 4.4CVE-2026-20437EPSS 0.08%

    In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431…

  38. 5.5CVE-2026-27950EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists …

  39. 5.5CVE-2026-26986EPSS 0.6%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)`…

  40. 5.5CVE-2026-25997EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during a…

  41. 5.5CVE-2026-25959EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_respo…

  42. 5.5CVE-2026-25955EPSS 0.6%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` f…

  43. 5.5CVE-2026-25954EPSS 0.6%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `rai…

  44. 5.5CVE-2026-25953EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` withou…

  45. 5.5CVE-2026-25952EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotec…

  46. 5.4CVE-2026-2804EPSS 0.5%

    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

  47. 9.8CVE-2026-2799EPSS 0.5%

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

  48. 8.8CVE-2026-2798EPSS 0.3%

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

  49. 9.8CVE-2026-2797EPSS 0.5%

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

  50. 9.8CVE-2026-2795EPSS 0.3%

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.