CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
11161 vulnerabilities reference this CWE, most recent first.
GHSA-45RX-WW54-53RF
Vulnerability from github – Published: 2026-07-14 18:31 – Updated: 2026-07-14 18:31Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-49162"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:16:50Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-45rx-ww54-53rf",
"modified": "2026-07-14T18:31:59Z",
"published": "2026-07-14T18:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49162"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-45VP-VX4C-9JR2
Vulnerability from github – Published: 2024-07-16 12:30 – Updated: 2024-08-21 18:31In the Linux kernel, the following vulnerability has been resolved:
net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access afterwards, what we're accessing is freed memory.
Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior to calling ocelot_vlan_member_del().
{
"affected": [],
"aliases": [
"CVE-2022-48779"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-16T12:15:03Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\n\nocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if\nthis is the same as the port\u0027s pvid_vlan which we access afterwards,\nwhat we\u0027re accessing is freed memory.\n\nFix the bug by determining whether to clear ocelot_port-\u003epvid_vlan prior\nto calling ocelot_vlan_member_del().",
"id": "GHSA-45vp-vx4c-9jr2",
"modified": "2024-08-21T18:31:26Z",
"published": "2024-07-16T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48779"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-45W6-5FRG-3VFQ
Vulnerability from github – Published: 2026-07-19 12:30 – Updated: 2026-07-20 15:31In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before replacing page cache folio
fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().
{
"affected": [],
"aliases": [
"CVE-2026-53388"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T12:16:49Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before replacing page cache folio\n\nfuse_try_move_folio() unlocks the request on entry but does not\nre-lock it on the success path. This means fuse_chan_abort() can end the\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the\nsubsequent copy chain logic after fuse_try_move_folio() accesses the\nfuse_io_args, leading to use-after-free issues.\n\nFix this by calling lock_request() before replace_page_cache_folio().\nThis ensures the request is locked on the success path which will\nprevent the fuse_io_args from being freed while the later copying logic\nruns, and also ensures that the ap-\u003efolios[i]-\u003emapping is never null\nsince ap-\u003efolios[i] will always point to the newfolio after\nreplace_page_cache_folio().",
"id": "GHSA-45w6-5frg-3vfq",
"modified": "2026-07-20T15:31:44Z",
"published": "2026-07-19T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53388"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-45WV-CH7H-93HX
Vulnerability from github – Published: 2024-11-26 09:30 – Updated: 2024-11-26 09:30A race condition exists in a driver potentially leading to a use-after-free condition.
{
"affected": [],
"aliases": [
"CVE-2017-18153"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:04Z",
"severity": "HIGH"
},
"details": "A race condition exists in a driver potentially leading to a use-after-free condition.",
"id": "GHSA-45wv-ch7h-93hx",
"modified": "2024-11-26T09:30:50Z",
"published": "2024-11-26T09:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18153"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-45XC-QV8H-V2M4
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-58544"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:18:42Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-45xc-qv8h-v2m4",
"modified": "2026-07-14T18:32:41Z",
"published": "2026-07-14T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58544"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58544"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4645-H4XP-PJ82
Vulnerability from github – Published: 2024-07-30 00:34 – Updated: 2026-04-02 21:31A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash.
{
"affected": [],
"aliases": [
"CVE-2024-40776"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T23:15:11Z",
"severity": "MODERATE"
},
"details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash.",
"id": "GHSA-4645-h4xp-pj82",
"modified": "2026-04-02T21:31:48Z",
"published": "2024-07-30T00:34:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40776"
},
{
"type": "WEB",
"url": "https://www.secpod.com/blog/apple-fixes-multiple-security-vulnerabilities-in-july-2024-updates"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214124"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214123"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214122"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214119"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214117"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214116"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214124"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214123"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214122"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214121"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214119"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214117"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214116"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120916"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120915"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120914"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120913"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120911"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120909"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120908"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/15"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/16"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/17"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/18"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/21"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/22"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jul/23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-465V-39XQ-8C56
Vulnerability from github – Published: 2022-05-14 02:13 – Updated: 2024-10-21 15:32Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
{
"affected": [],
"aliases": [
"CVE-2016-5281"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-22T22:59:00Z",
"severity": "CRITICAL"
},
"details": "Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird \u003c 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.",
"id": "GHSA-465v-39xq-8c56",
"modified": "2024-10-21T15:32:16Z",
"published": "2022-05-14T02:13:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5281"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1284690"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2016-86"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2016-88"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1912.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3674"
},
{
"type": "WEB",
"url": "http://www.geeknik.net/7gr1u98b9"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2016/mfsa2016-85.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93049"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036852"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-465V-48JM-5P9P
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-32070"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T18:17:07Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-465v-48jm-5p9p",
"modified": "2026-04-14T18:30:39Z",
"published": "2026-04-14T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32070"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32070"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-466H-JR37-234F
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
{
"affected": [],
"aliases": [
"CVE-2021-3392"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-23T20:15:00Z",
"severity": "LOW"
},
"details": "A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object \u0027req\u0027 from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.",
"id": "GHSA-466h-jr37-234f",
"modified": "2022-05-24T17:45:08Z",
"published": "2022-05-24T17:45:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3392"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/qemu/+bug/1914236"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924042"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210507-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-466M-2WP7-Q9Q9
Vulnerability from github – Published: 2026-03-25 12:30 – Updated: 2026-04-24 18:30In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Fix use-after-free on error path
In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has been released.
Move the pr_err() call before kfree(t) to access the fields while the memory is still valid.
This issue reported by Smatch static analyser
{
"affected": [],
"aliases": [
"CVE-2026-23344"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T11:16:32Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix use-after-free on error path\n\nIn the error path of sev_tsm_init_locked(), the code dereferences \u0027t\u0027\nafter it has been freed with kfree(). The pr_err() statement attempts\nto access t-\u003etio_en and t-\u003etio_init_done after the memory has been\nreleased.\n\nMove the pr_err() call before kfree(t) to access the fields while the\nmemory is still valid.\n\nThis issue reported by Smatch static analyser",
"id": "GHSA-466m-2wp7-q9q9",
"modified": "2026-04-24T18:30:40Z",
"published": "2026-03-25T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23344"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/79a26fe3175b9ed7c0c9541b197cb9786237c0f7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/889b0e2721e793eb46cf7d17b965aa3252af3ec8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.