CWE-416: Use After Free, page 80
Filter
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
What the weakness is: CWE-416 at MITRE
Ask an AI about CWE-416
Show the prompt
Explain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2025-37738EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported is…
- 7.8CVE-2025-23142EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socke…
- 7.5CVE-2025-30194EPSS 2.3%
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service…
- 5.7CVE-2025-31197EPSS 0.3%
The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may caus…
- 8.8CVE-2025-24252EPSS 1.3%
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on th…
- 8.8CVE-2025-1048EPSS 0.5%
Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 300 speakers. Authentication is not req…
- 7.8CVE-2025-1046EPSS 0.3%
Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit t…
- 7.8CVE-2025-37838EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit…
- 8.8CVE-2021-47670EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is acc…
- 7.8CVE-2021-47669EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcan_xmit: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the canfd_frame cfd which aliases skb memory is a…
- 8.8CVE-2021-47668EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is acces…
- 8.1CVE-2025-1290EPSS 0.3%
A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall …
- 6.5CVE-2025-1704EPSS 0.2%
ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices and intercept device management requests via loading components from the unencr…
- 8.8CVE-2025-3620EPSS 0.3%
Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 7.8CVE-2025-22126EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can r…
- 7.8CVE-2025-22097EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_co…
- 9.8CVE-2025-22088EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cau…
- 7.8CVE-2025-22085EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: =============================================…
- 7.8CVE-2025-22083EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between the…
- 7.8CVE-2025-22068EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_u…
- 8.8CVE-2025-22041EPSS 0.7%
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session throug…
- 8.8CVE-2025-22040EPSS 0.7%
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed befo…
- 7.0CVE-2025-22036EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to…
- 7.8CVE-2025-22035EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testin…
- 5.5CVE-2025-22024EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from…
- 7.8CVE-2024-58093EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we …
- 7.8CVE-2025-22023EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stopped") in v6.11, th…
- 7.8CVE-2025-22020EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ===============================================================…
- 8.8CVE-2023-42970EPSS 0.6%
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.
- 3.7CVE-2025-3416EPSS 0.5%
A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL trea…
- 7.8CVE-2025-29824KEVEPSS 19%
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-29823EPSS 0.7%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-29820EPSS 0.8%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- 7.3CVE-2025-29792EPSS 1.2%
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27751ExploitEPSS 2.5%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27750EPSS 0.9%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27749EPSS 1.1%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27748EPSS 1.1%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27746EPSS 0.9%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27745EPSS 1.1%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.8CVE-2025-27730EPSS 0.6%
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27729EPSS 0.8%
Use after free in Windows Shell allows an unauthorized attacker to execute code locally.
- 7.0CVE-2025-27492EPSS 0.4%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
- 7.1CVE-2025-27491EPSS 1.4%
Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.
- 8.1CVE-2025-27480EPSS 13%
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2025-27476EPSS 0.6%
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27467EPSS 0.6%
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-27200EPSS 0.4%
Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vi…
- 7.5CVE-2025-26687EPSS 1.2%
Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
- 6.7CVE-2025-26681EPSS 0.6%
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.