CWE-416: Use After Free, page 76
Filter
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
What the weakness is: CWE-416 at MITRE
Ask an AI about CWE-416
Show the prompt
Explain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2025-38476EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_…
- 7.8CVE-2025-38471EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try t…
- 1.9CVE-2025-8176EPSS 0.3%
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be appr…
- 7.8CVE-2025-38464EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(ne…
- 5.5CVE-2025-38449EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the …
- 7.8CVE-2025-38443EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets…
- 7.8CVE-2025-38437EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and …
- 5.5CVE-2025-38386EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to …
- 7.8CVE-2025-38378EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe In probe appletb_kbd_probe() a "struct appletb_kbd *kbd" is allocated via devm_kzalloc() to store touc…
- 7.8CVE-2025-38377EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rose_rt_device_down() There are two bugs in rose_rt_device_down() that can cause use-after-free: 1. The loop bound `t->count` i…
- 7.8CVE-2025-38369EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory mounted can trigg…
- 3.6CVE-2025-4878EPSS 0.2%
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to pos…
- 9.8CVE-2025-47917ExploitEPSS 2.4%
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output …
- 7.8CVE-2025-38350EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may u…
- 7.8CVE-2025-38349EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unloc…
- 8.8CVE-2025-7657EPSS 0.5%
Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 7.8CVE-2025-7042EPSS 0.2%
Use After Free vulnerability exists in the IPT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted IPT fi…
- 7.8CVE-2025-6973EPSS 0.2%
Use After Free vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
- 7.8CVE-2025-6972EPSS 0.2%
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted…
- 7.8CVE-2025-6971EPSS 0.2%
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted…
- 7.5CVE-2025-3631EPSS 0.4%
An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.
- 8.7CVE-2025-52946EPSS 0.5%
A Use After Free vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an attacker sending a BGP update with a specifically malformed AS PATH to cause rpd to crash, res…
- 7.8CVE-2025-7425EPSS 0.4%
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the prope…
- 7.8CVE-2025-38346EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d021…
- 7.8CVE-2025-38323EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to prot…
- 7.8CVE-2025-38289EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver u…
- 7.8CVE-2025-38259EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset…
- 7.8CVE-2025-38250EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file …
- 7.8CVE-2025-38248EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consu…
- 8.1CVE-2025-49735EPSS 1.2%
Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2025-49733EPSS 0.3%
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-49726EPSS 0.4%
Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-49725EPSS 0.3%
Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2025-49724EPSS 9.8%
Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2025-49711EPSS 0.5%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-49703EPSS 0.8%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-49700EPSS 0.4%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- 7.0CVE-2025-49699EPSS 0.4%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-49698EPSS 0.6%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- 8.4CVE-2025-49695EPSS 0.7%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.0CVE-2025-49685EPSS 0.4%
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- 7.3CVE-2025-49682EPSS 0.6%
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2025-49677ExploitEPSS 1.1%
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-49675EPSS 0.4%
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-49665EPSS 0.3%
Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-49660EPSS 0.4%
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
- 7.1CVE-2025-48821EPSS 0.5%
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent network.
- 7.8CVE-2025-48806EPSS 0.4%
Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally.
- 7.8CVE-2025-48000EPSS 0.3%
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-47991EPSS 0.4%
Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.