CWE-763: Release of Invalid Pointer or Reference
Filter
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
What the weakness is: CWE-763 at MITRE. All weaknesses
Ask an AI about CWE-763
Show the prompt
Explain CWE-763: Release of Invalid Pointer or Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/763.html and https://cve.bz/cve/cwe/763?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 0.0CVE-2026-119341EPSS 0.3%
Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any …
- 8.2CVE-2026-112893EPSS 0.5%
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale gl…
- 5.3CVE-2026-68908EPSS 0.5%
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report…
- 8.8CVE-2026-97011EPSS 0.8%
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-85850EPSS 0.3%
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-85362EPSS 0.2%
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-83908EPSS 0.3%
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2026-83889EPSS 1.1%
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
- 7.8CVE-2026-83735EPSS 0.4%
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-108133EPSS 0.4%
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2026-100813EPSS 0.2%
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- 5.5CVE-2026-98160EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_sd…
- 7.6CVE-2026-88340EPSS 0.2%
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_ru…
- 7.8CVE-2026-77500EPSS 0.3%
Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
- 8.5CVE-2026-74860EPSS 0.7%
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This t…
- 5.8CVE-2026-16005EPSS 0.1%
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BS…
- 8.8CVE-2026-84131EPSS 0.3%
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- 6.4CVE-2023-20511EPSS 0.4%
Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution.
- 9.3CVE-2026-19315EPSS 0.7%
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- 8.8CVE-2026-74947EPSS 0.4%
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- 5.5CVE-2026-63986EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepare_…
- 7.8CVE-2026-63809EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter…
- 4.3CVE-2026-15718EPSS 0.5%
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
- 7.8CVE-2026-57248EPSS 0.2%
When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the ap…
- 7.8CVE-2026-53000EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the origin…
- 9.8CVE-2026-52993EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was be…
- 7.5CVE-2026-9516EPSS 0.4%
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past th…
- 7.8CVE-2026-46189EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so c…
- 7.8CVE-2026-46116EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller lo…
- 7.5CVE-2026-47312EPSS 0.3%
Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- 7.5CVE-2025-48431EPSS 1.0%
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Spec…
- 5.5CVE-2025-65116EPSS 0.1%
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Manageme…
- 6.9CVE-2018-25243EPSS 0.1%
FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the…
- 9.8CVE-2026-22770EPSS 0.4%
ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last ele…
- 9.3CVE-2025-14233EPSS 0.8%
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. …
- 6.5CVE-2025-48768EPSS 0.8%
Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inode removal leading to a debug assert trigger (that is disabled by default), NULL …
- 8.7CVE-2025-13824EPSS 0.3%
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault w…
- 8.7CVE-2025-11838EPSS 0.5%
A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a…
- 5.3CVE-2025-54333EPSS 0.3%
An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Invalid Pointer Dereference of node in the get_vs4l_profiler_node function.
- 7.8CVE-2025-47329EPSS 0.09%
Memory corruption while handling invalid inputs in application info setup.
- 8.8CVE-2025-25215EPSS 2.6%
An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An at…
- 8.4CVE-2025-47749EPSS 0.2%
V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbi…
- 7.8CVE-2025-30379EPSS 0.6%
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 5.5CVE-2022-49160EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping t…
- 5.5CVE-2024-56573EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. …
- 9.8CVE-2024-44852EPSS 0.6%
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan().
- 3.3CVE-2024-50057EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Free IRQ only if it was requested before In polling mode, if no IRQ was requested there is no need to free it. Call devm_free_irq() only if client->irq…
- 5.9CVE-2024-25074EPSS 0.4%
An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W92…
- 7.1CVE-2024-42132EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida all…
- 5.5CVE-2022-48835EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Page fault in reply q processing A page fault was encountered in mpt3sas on a LUN reset error path: [ 145.763216] mpt3sas_cm1: Task abort tm failed: han…