cve.bz

CWE-416: Use After Free, page 69

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-53768EPSS 0.3%

    Use after free in Xbox allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2025-53150EPSS 0.3%

    Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

  3. 7.8CVE-2025-50175EPSS 0.4%

    Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

  4. 7.0CVE-2025-50174EPSS 0.4%

    Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.

  5. 9.9CVE-2025-49708EPSS 1.3%

    Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

  6. 7.0CVE-2025-48004EPSS 2.2%

    Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

  7. 9.8CVE-2025-11719EPSS 0.4%

    Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

  8. 9.8CVE-2025-11708EPSS 0.5%

    Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

  9. 7.5CVE-2025-62170EPSS 0.4%

    rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerabilit…

  10. 5.5CVE-2025-58299EPSS 0.10%

    Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.

  11. 5.5CVE-2025-58287EPSS 0.1%

    Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.

  12. 6.1CVE-2025-52885EPSS 0.2%

    Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from …

  13. 7.0CVE-2025-23280EPSS 0.2%

    NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, …

  14. 8.4CVE-2025-61864EPSS 0.2%

    A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.

  15. 7.8CVE-2025-47354EPSS 0.09%

    Memory corruption while allocating buffers in DSP service.

  16. 7.1CVE-2025-47342EPSS 0.2%

    Transient DOS may occur when multi-profile concurrency arises with QHS enabled.

  17. 7.8CVE-2023-53673EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connection…

  18. 7.8CVE-2023-53645EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpf_refcount_acquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpf_refcount series [0], specifically that the …

  19. 7.8CVE-2023-53640EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" …

  20. 7.8CVE-2023-53638EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: octeon_ep: cancel queued works in probe error path If it fails to get the devices's MAC address, octep_probe exits while leaving the delayed work intr_poll_task queued. …

  21. 7.8CVE-2023-53636EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: clk: microchip: fix potential UAF in auxdev release callback Similar to commit 1c11289b34ab ("peci: cpu: Fix use-after-free in adev_release()"), the auxiliary device is …

  22. 7.8CVE-2023-53629EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: [ 1…

  23. 7.8CVE-2023-53619EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_connt…

  24. 7.8CVE-2022-50552EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when reinitializing hardware queues. The queue…

  25. 7.8CVE-2022-50542EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which co…

  26. 8.7CVE-2025-59734EPSS 0.2%

    It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx->stored_frame. Stored frames can later be …

  27. 7.8CVE-2023-53613EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dax: Fix dax_mapping_release() use after free A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields: kobject:…

  28. 7.8CVE-2023-53608EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which te…

  29. 7.8CVE-2023-53587EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but…

  30. 7.8CVE-2023-53572EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: use _safe list iterator to avoid a use after free This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). Otherwise it dereferences a fr…

  31. 7.8CVE-2023-53560EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Add histograms to hist_vars if they have referenced variables Hist triggers can have referenced variables without having direct variables fields. Thi…

  32. 7.8CVE-2023-53559EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during …

  33. 7.8CVE-2023-53556EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors …

  34. 7.8CVE-2023-53552EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) a…

  35. 7.8CVE-2023-53544EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: davinci: Fix clk use after free The remove function first frees the clks and only then calls cpufreq_unregister_driver(). If one of the cpufreq callbacks is cal…

  36. 7.8CVE-2023-53537EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folio_end_writeback+0x8a/0x90 Call Tr…

  37. 7.8CVE-2023-53536EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: blk-crypto: make blk_crypto_evict_key() more robust If blk_crypto_evict_key() sees that the key is still in-use (due to a bug) or that ->keyslot_evict failed, it current…

  38. 7.8CVE-2022-50507EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate data run offset This adds sanity checks for data run offset. We should make sure data run offset is legit before trying to unpack them, otherwise we m…

  39. 7.8CVE-2022-50496EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy() Dm_cache also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in destroy().

  40. 7.8CVE-2022-50492EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix use-after-free on probe deferral The bridge counter was never reset when tearing down the DRM device so that stale pointers to deallocated structures would …

  41. 7.8CVE-2022-50488EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible uaf for 'bfqq->bic' Our test report a uaf for 'bfqq->bic' in 5.10: ================================================================== BUG: KASA…

  42. 7.8CVE-2025-39951EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though …

  43. 7.8CVE-2025-39945EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work…

  44. 7.8CVE-2025-39944EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delay…

  45. 9.9CVE-2025-49844ExploitEPSS 83%

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lea…

  46. 9.4CVE-2025-10729EPSS 0.2%

    The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.

  47. 7.5CVE-2025-11234EPSS 0.9%

    A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. T…

  48. 7.1CVE-2025-61692EPSS 0.1%

    VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.

  49. 8.1CVE-2025-46205EPSS 0.4%

    A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file. NOTE: this is disputed by the Supplier because there is no…

  50. 7.8CVE-2023-53515EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct…