cve.bz

CWE-416: Use After Free, page 81

Filter

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

What the weakness is: CWE-416 at MITRE

Ask an AI about CWE-416

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-26679EPSS 0.6%

    Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally.

  2. 8.1CVE-2025-26671EPSS 1.2%

    Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

  3. 8.1CVE-2025-26670EPSS 11%

    Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

  4. 8.1CVE-2025-26663EPSS 1.8%

    Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

  5. 7.0CVE-2025-26649EPSS 0.4%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2025-26648EPSS 0.5%

    Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.

  7. 7.0CVE-2025-26640EPSS 0.5%

    Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

  8. 8.3CVE-2025-31498EPSS 0.6%

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not proper…

  9. 7.8CVE-2025-21437EPSS 0.1%

    Memory corruption while processing memory map or unmap IOCTL operations simultaneously.

  10. 7.8CVE-2025-21436EPSS 0.1%

    Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.

  11. 6.7CVE-2024-49848EPSS 0.1%

    Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

  12. 6.6CVE-2024-45544EPSS 0.1%

    Memory corruption while processing IOCTL calls to add route entry in the HW.

  13. 6.6CVE-2024-45540EPSS 0.1%

    Memory corruption while invoking IOCTL map buffer request from userspace.

  14. 7.8CVE-2024-43066EPSS 0.1%

    Memory corruption while handling file descriptor during listener registration/de-registration.

  15. 9.2CVE-2024-11235EPSS 1.5%

    In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to thi…

  16. 7.6CVE-2025-29815EPSS 0.8%

    Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

  17. 8.7CVE-2025-31115EPSS 0.7%

    XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects includ…

  18. 8.6CVE-2025-22004EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

  19. 7.8CVE-2025-21999EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a modul…

  20. 8.8CVE-2025-3066EPSS 0.4%

    Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  21. 7.8CVE-2025-21979EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiph…

  22. 7.8CVE-2025-21969EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released …

  23. 7.8CVE-2025-21968EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free on hdcp_work [Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still runni…

  24. 7.8CVE-2025-21967EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_free_work_struct ->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. Th…

  25. 7.8CVE-2025-21945EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error han…

  26. 7.8CVE-2025-21934EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rath…

  27. 7.8CVE-2025-21929EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in …

  28. 7.8CVE-2025-21928EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs …

  29. 7.8CVE-2025-21923EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This ca…

  30. 7.8CVE-2025-21915EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() i…

  31. 7.8CVE-2025-21896EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio r…

  32. 8.1CVE-2025-3030EPSS 0.5%

    Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…

  33. 6.5CVE-2025-3028EPSS 0.9%

    JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

  34. 4.3CVE-2025-30427EPSS 0.8%

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted we…

  35. 7.8CVE-2025-21893EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to…

  36. 1.9CVE-2025-2913EPSS 0.3%

    A vulnerability was found in HDF5 up to 1.14.6. It has been rated as critical. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c. The manipulation of the argument H5FL_blk_head_t leads to use after free. An at…

  37. 7.8CVE-2025-30232EPSS 0.5%

    A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.

  38. 7.8CVE-2023-53023EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e…

  39. 7.8CVE-2023-53021EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro install…

  40. 5.5CVE-2023-53016EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lo…

  41. 7.8CVE-2023-53003EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the priv…

  42. 7.8CVE-2023-52999EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: fix UaF in netns ops registration error path If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in suc…

  43. 7.8CVE-2023-52983EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bic_set_bfqq() After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), bic->bfqq will be accessed in bic_set_bfqq(), …

  44. 7.8CVE-2023-52975EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses t…

  45. 7.8CVE-2023-52974EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be acce…

  46. 7.8CVE-2023-52973EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate…

  47. 7.8CVE-2023-52935EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any …

  48. 7.8CVE-2023-52931EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid potential vm use-after-free Adding the vm to the vm_xa table makes it visible to userspace, which could try to race with us to close the vm. So we need …

  49. 7.8CVE-2022-49761EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: btrfs: always report error in run_one_delayed_ref() Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but if end users hit such problem, there will be…

  50. 7.8CVE-2022-49755EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read…