cve.bz

CWE-416: Use After Free, page 63

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-21323EPSS 0.3%

    After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim …

  2. 7.8CVE-2026-21320EPSS 0.3%

    After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim …

  3. 7.0CVE-2026-21253EPSS 0.8%

    Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2026-21251EPSS 0.4%

    Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally.

  5. 7.0CVE-2026-21242EPSS 0.4%

    Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

  6. 7.0CVE-2026-21241EPSS 2.6%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  7. 7.0CVE-2026-21237EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

  8. 7.3CVE-2026-21235EPSS 0.7%

    Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  9. 1.9CVE-2025-15570EPSS 0.2%

    A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made…

  10. 8.7CVE-2026-24684EPSS 0.6%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat…

  11. 8.7CVE-2026-24683EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callbac…

  12. 8.7CVE-2026-24681EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. Thi…

  13. 8.7CVE-2026-24680EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.…

  14. 8.7CVE-2026-24678EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This …

  15. 8.7CVE-2026-24677EPSS 0.6%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. T…

  16. 7.7CVE-2026-24676EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_c…

  17. 7.7CVE-2026-24675EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interfa…

  18. 7.7CVE-2026-24491EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerabi…

  19. 5.5CVE-2026-24927EPSS 0.1%

    Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability.

  20. 5.5CVE-2026-24930EPSS 0.08%

    UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.

  21. 5.5CVE-2026-24917EPSS 0.1%

    UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.

  22. 5.5CVE-2026-24914EPSS 0.1%

    Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.

  23. 1.9CVE-2026-1979EPSS 0.2%

    A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched loca…

  24. 6.3CVE-2026-25507EPSS 0.2%

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocomm_ble) layer. The issue can …

  25. 7.8CVE-2026-23089EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added …

  26. 7.8CVE-2026-23077EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge Patch series "mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge", v2. Commit 879bca0a2c4f ("mm…

  27. 7.8CVE-2026-23074EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constra…

  28. 7.8CVE-2025-47398EPSS 0.1%

    Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

  29. 7.8CVE-2025-47359EPSS 0.1%

    Memory Corruption when multiple threads simultaneously access a memory free API.

  30. 7.8CVE-2025-47358EPSS 0.1%

    Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.

  31. 6.7CVE-2026-20414EPSS 0.1%

    In imgsys, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.…

  32. 7.8CVE-2026-20411EPSS 0.1%

    In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pa…

  33. 7.5CVE-2025-63652EPSS 1.2%

    A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.

  34. 7.5CVE-2025-63651EPSS 1.1%

    A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.

  35. 7.8CVE-2025-33220EPSS 0.2%

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of this vulnerability might lead to code execution, escalation…

  36. 7.8CVE-2025-33217EPSS 0.2%

    NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of servi…

  37. 9.1CVE-2026-22264EPSS 0.4%

    Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and …

  38. 8.8CVE-2026-24869EPSS 0.3%

    Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.

  39. 7.8CVE-2026-23013EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails p…

  40. 7.8CVE-2026-23012EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context that is not running, the function returns error while keeping…

  41. 7.8CVE-2026-23010EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr(…

  42. 4.7CVE-2026-23004EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Cras…

  43. 7.8CVE-2026-23001EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must c…

  44. 5.5CVE-2026-22999EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc…

  45. 7.8CVE-2025-71162EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. Th…

  46. 9.8CVE-2025-13952EPSS 0.5%

    A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system…

  47. 7.8CVE-2026-22995EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free …

  48. 7.8CVE-2026-22980EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl…

  49. 7.8CVE-2025-71159EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delayed_node() set the delayed_node's refcount before acquiring t…

  50. 9.8CVE-2026-0794EPSS 0.7%

    ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not …