CWE-416: Use After Free, page 72
Filter
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
What the weakness is: CWE-416 at MITRE
Ask an AI about CWE-416
Show the prompt
Explain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2022-50240EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of fail…
- 9.8CVE-2024-45434EPSS 7.3%
OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object before performing operations on the …
- 5.5CVE-2025-39785EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local The local variable is passed in request_irq (), and there will be use after free problem, which will …
- 7.8CVE-2025-39776EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also it…
- 7.8CVE-2025-39740EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if there is one) has already been put() prior to this, so doing a fence_wait could le…
- 8.8CVE-2025-10200EPSS 0.6%
Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- 7.8CVE-2025-54258EPSS 0.2%
Substance3D - Modeler versions 1.22.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…
- 7.8CVE-2025-54257EPSS 0.3%
Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requir…
- 7.8CVE-2025-54242EPSS 0.2%
Premiere Pro versions 25.3, 24.6.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a …
- 7.8CVE-2025-55228EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
- 7.8CVE-2025-55224EPSS 0.4%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
- 7.0CVE-2025-55223EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-54913EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-54912EPSS 0.5%
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- 7.3CVE-2025-54911EPSS 0.8%
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-54908EPSS 0.6%
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-54906EPSS 0.8%
Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-54904EPSS 0.6%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-54903EPSS 0.6%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-54902EPSS 0.6%
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-54896EPSS 0.6%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.0CVE-2025-54112EPSS 0.4%
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-54111EPSS 0.4%
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2025-54108EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2025-54105EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- 7.4CVE-2025-54103EPSS 0.4%
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.
- 7.8CVE-2025-54102EPSS 0.5%
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
- 4.8CVE-2025-54101EPSS 3.1%
Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network.
- 7.8CVE-2025-54092EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2025-53807EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2025-53802EPSS 0.4%
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
- 8.1CVE-2025-36854EPSS 0.6%
A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote C…
- 5.3CVE-2025-3212EPSS 0.3%
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing oper…
- 5.5CVE-2025-39721EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead …
- 7.8CVE-2025-39717EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_…
- 7.8CVE-2025-39711EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function…
- 5.5CVE-2025-39698EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the reques…
- 7.8CVE-2025-39691EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at a…
- 7.8CVE-2025-39689EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global trac…
- 7.8CVE-2025-38734EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 …
- 8.8CVE-2025-48543KEVEPSS 0.6%
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…
- 8.0CVE-2025-48539EPSS 0.4%
In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not nee…
- 7.8CVE-2025-32332EPSS 0.09%
In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8CVE-2025-38724EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get…
- 7.8CVE-2025-38722EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all…
- 7.8CVE-2025-38708EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if y…
- 7.8CVE-2025-38703EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get…
- 7.5CVE-2025-54588EPSS 0.5%
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal proc…
- 7.8CVE-2025-22438EPSS 0.1%
In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…
- 7.5CVE-2025-57616EPSS 0.4%
An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a denial of service or memory corruption. The method violates Rust's aliasing rul…