cve.bz

CWE-416: Use After Free, page 78

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-0073EPSS 0.2%

    Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already…

  2. 7.4CVE-2023-26226EPSS 0.4%

    A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682

  3. 7.8CVE-2025-44906EPSS 0.3%

    jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

  4. 5.4CVE-2025-5283EPSS 0.6%

    Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

  5. 8.8CVE-2025-5063EPSS 3.7%

    Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  6. 7.3CVE-2025-48798EPSS 0.2%

    A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and ca…

  7. 9.8CVE-2025-48752EPSS 0.4%

    In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.

  8. 8.0CVE-2025-5100EPSS 0.3%

    A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution.

  9. 7.8CVE-2025-37957EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue wher…

  10. 7.8CVE-2025-37952EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. …

  11. 7.8CVE-2025-37946EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs With commit bcb5d6c76903 ("s390/pci: introduce lock to synchronize state of zpci_dev's") th…

  12. 7.8CVE-2025-37926EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_loc…

  13. 7.8CVE-2025-37924EPSS 25%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is poss…

  14. 7.8CVE-2025-37916EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_…

  15. 7.8CVE-2025-37903EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free in hdcp The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference…

  16. 7.8CVE-2025-37899EPSS 0.9%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup r…

  17. 7.5CVE-2025-1706EPSS 0.5%

    Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.

  18. 7.8CVE-2025-37890EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child…

  19. 5.9CVE-2025-4516EPSS 0.2%

    There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop usi…

  20. 7.8CVE-2025-43571EPSS 0.3%

    Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  21. 7.8CVE-2025-43570EPSS 0.3%

    Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  22. 7.8CVE-2025-43568EPSS 0.3%

    Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  23. 7.8CVE-2025-43549EPSS 0.3%

    Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…

  24. 7.0CVE-2025-20062EPSS 0.2%

    Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  25. 7.2CVE-2025-20046EPSS 0.2%

    Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  26. 8.3CVE-2025-20006EPSS 0.3%

    Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  27. 7.8CVE-2025-32709KEVEPSS 1.8%

    Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  28. 7.8CVE-2025-32701KEVEPSS 1.4%

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2025-30400KEVEPSS 1.9%

    Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

  30. 7.8CVE-2025-30393EPSS 0.5%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  31. 7.8CVE-2025-30386EPSS 0.7%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  32. 7.8CVE-2025-30385EPSS 0.5%

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2025-30377EPSS 0.7%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  34. 7.8CVE-2025-29978EPSS 0.6%

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  35. 7.8CVE-2025-29977EPSS 0.6%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  36. 7.8CVE-2025-29970EPSS 0.5%

    Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  37. 7.0CVE-2025-29841EPSS 0.4%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Universal Print Management Service allows an authorized attacker to elevate privileges locally.

  38. 7.5CVE-2025-29831EPSS 1.0%

    Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

  39. 4.3CVE-2025-31239EPSS 0.7%

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Par…

  40. 7.8CVE-2023-53145EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_…

  41. 7.8CVE-2025-37885EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents pos…

  42. 7.8CVE-2025-37882EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it'…

  43. 7.8CVE-2025-37869EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return. The cod…

  44. 7.8CVE-2025-37861EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the t…

  45. 7.8CVE-2025-37854EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort e…

  46. 7.8CVE-2025-37849EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl b…

  47. 7.8CVE-2025-37845EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tra…

  48. 6.9CVE-2025-31946EPSS 0.3%

    Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corruption or a system crash.

  49. 8.7CVE-2025-27578EPSS 1.0%

    Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition.

  50. 7.8CVE-2025-37823EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a r…