CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
9868 vulnerabilities reference this CWE, most recent first.
GHSA-G9QG-RG7J-WHHX
Vulnerability from github – Published: 2022-02-28 00:00 – Updated: 2022-03-26 00:01In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
{
"affected": [],
"aliases": [
"CVE-2021-21708"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-27T08:15:00Z",
"severity": "CRITICAL"
},
"details": "In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.",
"id": "GHSA-g9qg-rg7j-whhx",
"modified": "2022-03-26T00:01:02Z",
"published": "2022-02-28T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21708"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=81708"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202209-20"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220325-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9R6-5MW5-CWJP
Vulnerability from github – Published: 2022-05-14 01:41 – Updated: 2022-05-14 01:41Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 820, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016.
{
"affected": [],
"aliases": [
"CVE-2017-18328"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-03T15:29:00Z",
"severity": "HIGH"
},
"details": "Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 820, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016.",
"id": "GHSA-g9r6-5mw5-cwjp",
"modified": "2022-05-14T01:41:57Z",
"published": "2022-05-14T01:41:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18328"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106128"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9RM-H86M-2XRR
Vulnerability from github – Published: 2026-04-13 06:30 – Updated: 2026-04-13 06:30UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
{
"affected": [],
"aliases": [
"CVE-2026-34859"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-13T05:16:03Z",
"severity": "MODERATE"
},
"details": "UAF vulnerability in the kernel module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality.",
"id": "GHSA-g9rm-h86m-2xrr",
"modified": "2026-04-13T06:30:31Z",
"published": "2026-04-13T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34859"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2026/4"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletinvision/2026/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G9V6-QF5C-6V3H
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2021-37970"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-08T22:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"id": "GHSA-g9v6-qf5c-6v3h",
"modified": "2022-05-24T19:17:06Z",
"published": "2022-05-24T19:17:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37970"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1248030"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PM7MOYYHJSWLIFZ4TPJTD7MSA3HSSLV2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5046"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9VW-6PVX-7GMW
Vulnerability from github – Published: 2025-09-15 16:46 – Updated: 2025-09-15 16:46Summary
A use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.
Details
The vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:
- Dynamic Forwarding Filter is enabled.
envoy.reloadable_features.dfp_cluster_resolves_hostsruntime flag is enabled.- The Host header is modified between the Dynamic Forwarding Filter and Router filters.
Impact
Denial of service due to abnormal process termination.
Attack vector(s)
Request to Envoy configured as indicated above.
Patches
Users should upgrade to v1.35.1 or v1.34.5.
Workaround
Set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.
Detection
Abnormal process termination with the Envoy::Event::DispatcherImpl::runPostCallbacks() frame in the call stack.
Credits
Rohit Agrawal (agrawroh) (rohit.agrawal@databricks.com)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/envoyproxy/envoy"
},
"ranges": [
{
"events": [
{
"introduced": "1.35.0"
},
{
"fixed": "1.35.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.35.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/envoyproxy/envoy"
},
"ranges": [
{
"events": [
{
"introduced": "1.34.0"
},
{
"fixed": "1.34.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54588"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T16:46:37Z",
"nvd_published_at": "2025-09-03T00:15:30Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA use-after-free (UAF) vulnerability in Envoy\u0027s DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.\n\n### Details\n\nThe vulnerability exists in Envoy\u0027s Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:\n\n1. Dynamic Forwarding Filter is enabled.\n2. `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled.\n3. The Host header is modified between the Dynamic Forwarding Filter and Router filters.\n\n### Impact\n\nDenial of service due to abnormal process termination.\n\n### Attack vector(s)\nRequest to Envoy configured as indicated above.\n\n### Patches\nUsers should upgrade to v1.35.1 or v1.34.5. \n\n### Workaround\nSet the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag to `false`.\n\n### Detection\nAbnormal process termination with the `Envoy::Event::DispatcherImpl::runPostCallbacks()` frame in the call stack.\n\n### Credits\nRohit Agrawal ([agrawroh](https://github.com/agrawroh)) ([rohit.agrawal@databricks.com](mailto:rohit.agrawal@databricks.com))",
"id": "GHSA-g9vw-6pvx-7gmw",
"modified": "2025-09-15T16:46:37Z",
"published": "2025-09-15T16:46:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54588"
},
{
"type": "PACKAGE",
"url": "https://github.com/envoyproxy/envoy"
},
{
"type": "WEB",
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5"
},
{
"type": "WEB",
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults"
}
GHSA-G9W9-PQMH-3HM7
Vulnerability from github – Published: 2025-01-06 12:30 – Updated: 2025-01-06 12:30Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
{
"affected": [],
"aliases": [
"CVE-2024-45553"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T11:15:10Z",
"severity": "HIGH"
},
"details": "Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.",
"id": "GHSA-g9w9-pqmh-3hm7",
"modified": "2025-01-06T12:30:33Z",
"published": "2025-01-06T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45553"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9WG-9Q28-6WX7
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-06 03:31Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-11002"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:17:03Z",
"severity": "CRITICAL"
},
"details": "Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-g9wg-9q28-6wx7",
"modified": "2026-06-06T03:31:21Z",
"published": "2026-06-05T00:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11002"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/494740162"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GC32-FMF5-C742
Vulnerability from github – Published: 2025-02-25 18:31 – Updated: 2026-04-06 15:31A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
{
"affected": [],
"aliases": [
"CVE-2025-26594"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-25T16:15:38Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.",
"id": "GHSA-gc32-fmf5-c742",
"modified": "2026-04-06T15:31:19Z",
"published": "2025-02-25T18:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26594"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-26594"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7458"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7165"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7163"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3976"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2880"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2879"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2875"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2873"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2865"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2862"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2861"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2502"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2500"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GC3H-6P88-M9MP
Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21873.
{
"affected": [],
"aliases": [
"CVE-2023-42094"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:15:46Z",
"severity": "HIGH"
},
"details": "Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21873.",
"id": "GHSA-gc3h-6p88-m9mp",
"modified": "2024-05-03T03:31:01Z",
"published": "2024-05-03T03:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42094"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1427"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GC3Q-F2FQ-G2XQ
Vulnerability from github – Published: 2024-06-11 15:31 – Updated: 2024-08-12 18:30Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125 and Firefox ESR < 115.12.
{
"affected": [],
"aliases": [
"CVE-2024-5702"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T13:15:51Z",
"severity": "HIGH"
},
"details": "Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox \u003c 125 and Firefox ESR \u003c 115.12.",
"id": "GHSA-gc3q-f2fq-g2xq",
"modified": "2024-08-12T18:30:45Z",
"published": "2024-06-11T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5702"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1193389"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-18"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-26"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-28"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.