Common Weakness Enumeration

CWE-416

Allowed

Use After Free

Abstraction: Variant · Status: Stable

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

9845 vulnerabilities reference this CWE, most recent first.

GHSA-3XH7-VF3H-529R

Vulnerability from github – Published: 2024-03-11 21:31 – Updated: 2024-08-26 18:33
VLAI
Details

In tbd of tbd, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-27205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-11T19:15:47Z",
    "severity": "HIGH"
  },
  "details": "In tbd of tbd, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-3xh7-vf3h-529r",
  "modified": "2024-08-26T18:33:32Z",
  "published": "2024-03-11T21:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27205"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2024-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3XJ5-QMXC-J3Q3

Vulnerability from github – Published: 2023-10-08 06:30 – Updated: 2024-04-04 08:24
VLAI
Details

In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-40632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-08T04:15:56Z",
    "severity": "HIGH"
  },
  "details": "In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed",
  "id": "GHSA-3xj5-qmxc-j3q3",
  "modified": "2024-04-04T08:24:09Z",
  "published": "2023-10-08T06:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40632"
    },
    {
      "type": "WEB",
      "url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1707266966118531074"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3XM2-XCVM-GHRH

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-12 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

reset: gpio: suppress bind attributes in sysfs

This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it and the actual reset consumer. Suppress sysfs bind attributes so that user-space can't unbind the device because - as of now - it will cause a use-after-free splat from any user that puts the reset control handle.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-43138"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:31Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: suppress bind attributes in sysfs\n\nThis is a special device that\u0027s created dynamically and is supposed to\nstay in memory forever. We also currently don\u0027t have a devlink between\nit and the actual reset consumer. Suppress sysfs bind attributes so that\nuser-space can\u0027t unbind the device because - as of now - it will cause a\nuse-after-free splat from any user that puts the reset control handle.",
  "id": "GHSA-3xm2-xcvm-ghrh",
  "modified": "2026-05-12T21:31:26Z",
  "published": "2026-05-06T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43138"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3XPR-X643-29V6

Vulnerability from github – Published: 2024-01-31 15:30 – Updated: 2024-01-31 15:30
VLAI
Details

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.

We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-1085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-31T13:15:10Z",
    "severity": "HIGH"
  },
  "details": "A use-after-free vulnerability in the Linux kernel\u0027s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.\n\nWe recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.\n\n",
  "id": "GHSA-3xpr-x643-29v6",
  "modified": "2024-01-31T15:30:19Z",
  "published": "2024-01-31T15:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1085"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7"
    },
    {
      "type": "WEB",
      "url": "https://kernel.dance/b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3XX9-5W7V-MP8G

Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18
VLAI
Details

A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regions will be freed and cause use-after-free condition.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2021-38467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-22T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regions will be freed and cause use-after-free condition.",
  "id": "GHSA-3xx9-5w7v-mp8g",
  "modified": "2022-05-24T19:18:40Z",
  "published": "2022-05-24T19:18:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38467"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-422F-2R32-F82H

Vulnerability from github – Published: 2025-09-16 18:31 – Updated: 2025-12-10 18:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Wait for io return on terminate rport

System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same resource.

Wait for IO's to return to upper layer before resources are freed.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-53322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-16T17:15:38Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Wait for io return on terminate rport\n\nSystem crash due to use after free.\nCurrent code allows terminate_rport_io to exit before making\nsure all IOs has returned. For FCP-2 device, IO\u0027s can hang\non in HW because driver has not tear down the session in FW at\nfirst sign of cable pull. When dev_loss_tmo timer pops,\nterminate_rport_io is called and upper layer is about to\nfree various resources. Terminate_rport_io trigger qla to do\nthe final cleanup, but the cleanup might not be fast enough where it\nleave qla still holding on to the same resource.\n\nWait for IO\u0027s to return to upper layer before resources are freed.",
  "id": "GHSA-422f-2r32-f82h",
  "modified": "2025-12-10T18:30:21Z",
  "published": "2025-09-16T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53322"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/079c8264ed9fea8cbcac01ad29040f901cbc3692"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4647d2e88918a078359d1532d90c417a38542c9e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5bcdaafd92be6035ddc77fa76650cf9dd5b864c4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a55556cd7e0220486163b1285ce11a8be2ce5fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90770dad1eb30967ebd8d37d82830bcf270b3293"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9fe97fb7b4ee21bffb76f2acb05769bad27ae70"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d25fded78d88e1515439b3ba581684d683e0b6ab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc0cba0c7be8261a1625098bd1d695077ec621c9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-422G-PHP3-XRV4

Vulnerability from github – Published: 2025-02-27 18:31 – Updated: 2025-02-27 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path:

ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF

Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2022-49388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_create_volume: Fix use-after-free when volume creation failed\n\nThere is an use-after-free problem for \u0027eba_tbl\u0027 in ubi_create_volume()\u0027s\nerror handling path:\n\n  ubi_eba_replace_table(vol, eba_tbl)\n    vol-\u003eeba_tbl = tbl\nout_mapping:\n  ubi_eba_destroy_table(eba_tbl)   // Free \u0027eba_tbl\u0027\nout_unlock:\n  put_device(\u0026vol-\u003edev)\n    vol_release\n      kfree(tbl-\u003eentries)\t  // UAF\n\nFix it by removing redundant \u0027eba_tbl\u0027 releasing.\nFetch a reproducer in [Link].",
  "id": "GHSA-422g-php3-xrv4",
  "modified": "2025-02-27T18:31:08Z",
  "published": "2025-02-27T18:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49388"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1174ab8ba36a48025b68b5ff1085000b1e510217"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5ff2514e4fb55dcf3d88294686040ca73ea0c1a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d8d3f68cbecfd31925796f0fb668eb21ab06734"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8302620aeb940f386817321d272b12411ae7d39f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c03a1c21d72210f81cb369cc528e3fde4b45411"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/abb67043060f2bf4c03d7c3debb9ae980e2b6db3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e27ecf325e51abd06aaefba57a6322a46fa4178b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-422V-QJRR-7JH4

Vulnerability from github – Published: 2025-03-19 21:30 – Updated: 2025-03-24 15:30
VLAI
Details

Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-2476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-19T19:15:50Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)",
  "id": "GHSA-422v-qjrr-7jh4",
  "modified": "2025-03-24T15:30:39Z",
  "published": "2025-03-19T21:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2476"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/401029609"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4243-7HWP-6PHP

Vulnerability from github – Published: 2025-05-06 09:31 – Updated: 2025-05-06 09:31
VLAI
Details

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-45554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-06T09:15:17Z",
    "severity": "HIGH"
  },
  "details": "Memory corruption during concurrent SSR execution due to race condition on the global maps list.",
  "id": "GHSA-4243-7hwp-6php",
  "modified": "2025-05-06T09:31:33Z",
  "published": "2025-05-06T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45554"
    },
    {
      "type": "WEB",
      "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-424X-PMW3-6VMM

Vulnerability from github – Published: 2022-05-17 02:40 – Updated: 2022-05-17 02:40
VLAI
Details

The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted binary file.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2017-9762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-19T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted binary file.",
  "id": "GHSA-424x-pmw3-6vmm",
  "modified": "2022-05-17T02:40:05Z",
  "published": "2022-05-17T02:40:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9762"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radare/radare2/issues/7726"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99140"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation
Architecture and Design

Strategy: Language Selection

Choose a language that provides automatic memory management.

Mitigation
Implementation

Strategy: Attack Surface Reduction

When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

No CAPEC attack patterns related to this CWE.