CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12195 vulnerabilities reference this CWE, most recent first.
GHSA-CPHH-QPCC-MFXG
Vulnerability from github – Published: 2024-05-08 00:31 – Updated: 2024-05-08 00:31Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15167.
{
"affected": [],
"aliases": [
"CVE-2021-34974"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T23:15:12Z",
"severity": "HIGH"
},
"details": "Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15167.",
"id": "GHSA-cphh-qpcc-mfxg",
"modified": "2024-05-08T00:31:14Z",
"published": "2024-05-08T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34974"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1205"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPJ9-X7FC-H34F
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 03:31Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-11074"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:17:12Z",
"severity": "HIGH"
},
"details": "Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-cpj9-x7fc-h34f",
"modified": "2026-06-05T03:31:33Z",
"published": "2026-06-05T00:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11074"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/499587071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPMQ-C39J-PM97
Vulnerability from github – Published: 2023-09-12 18:30 – Updated: 2024-04-04 07:38Windows TCP/IP Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-38160"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T17:15:21Z",
"severity": "MODERATE"
},
"details": "Windows TCP/IP Information Disclosure Vulnerability",
"id": "GHSA-cpmq-c39j-pm97",
"modified": "2024-04-04T07:38:14Z",
"published": "2023-09-12T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38160"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38160"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPPG-8QMF-5Q88
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-69473"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:12Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-cppg-8qmf-5q88",
"modified": "2026-09-08T18:32:38Z",
"published": "2026-09-08T18:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69473"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69473"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPQH-XQ9Q-22R9
Vulnerability from github – Published: 2026-10-13 21:34 – Updated: 2026-10-13 21:34Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-70115"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:19:23Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-cpqh-xq9q-22r9",
"modified": "2026-10-13T21:34:06Z",
"published": "2026-10-13T21:34:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70115"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70115"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPRV-RGR4-V7VH
Vulnerability from github – Published: 2025-10-03 18:31 – Updated: 2025-10-03 18:31The module will parse a node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.
{
"affected": [],
"aliases": [
"CVE-2025-10729"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-03T16:16:16Z",
"severity": "CRITICAL"
},
"details": "The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.",
"id": "GHSA-cprv-rgr4-v7vh",
"modified": "2025-10-03T18:31:27Z",
"published": "2025-10-03T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10729"
},
{
"type": "WEB",
"url": "https://codereview.qt-project.org/c/qt/qtsvg/+/676473"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-CPVC-XW97-5JM5
Vulnerability from github – Published: 2022-02-11 00:00 – Updated: 2022-02-12 00:00In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171675; Issue ID: ALPS06171675.
{
"affected": [],
"aliases": [
"CVE-2022-20035"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-09T23:15:00Z",
"severity": "MODERATE"
},
"details": "In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171675; Issue ID: ALPS06171675.",
"id": "GHSA-cpvc-xw97-5jm5",
"modified": "2022-02-12T00:00:53Z",
"published": "2022-02-11T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20035"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/February-2022"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CPVR-W4J5-2MPG
Vulnerability from github – Published: 2026-10-22 15:52 – Updated: 2026-10-22 15:52Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error.
While libxml2 is expanding an internal entity, a recursive XInclude
can parse another document that declares an entity with the same
name. Both parses use the same XmlState entity
map on the librsvg side. entity_insert() replaces the first entry, whose Drop
implementation calls xmlFreeNode(). The outer xmlCtxtParseEntity()
then keeps using the freed 144-byte xmlEntity.
The included parse should not free an entity that the outer parser is still using.
The fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where librsvg will no longer free xmlEntity pointers that libxml2 is still using.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "librsvg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.57.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "librsvg"
},
"ranges": [
{
"events": [
{
"introduced": "2.60.0-beta.0"
},
{
"fixed": "2.60.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "librsvg"
},
"ranges": [
{
"events": [
{
"introduced": "2.61.0"
},
{
"fixed": "2.61.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "librsvg"
},
"ranges": [
{
"events": [
{
"introduced": "2.62.0-beta.0"
},
{
"fixed": "2.62.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "librsvg"
},
"ranges": [
{
"events": [
{
"introduced": "2.63.0-beta.0"
},
{
"fixed": "2.63.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-96889"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-22T15:52:48Z",
"nvd_published_at": "2026-09-23T20:17:27Z",
"severity": "HIGH"
},
"details": "Librsvg uses libxml2, a C library, to parse XML. When librsvg parses\nan SVG document which has a nested Xinclude, an XML entity declaration\nwith a duplicate name as an existing one can cause a use-after-free error.\n\nWhile libxml2 is expanding an internal entity, a recursive XInclude\ncan parse another document that declares an entity with the same\nname. Both parses use the same `XmlState` entity\nmap on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`\nimplementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`\nthen keeps using the freed 144-byte `xmlEntity`.\n\nThe included parse should not free an entity that the outer parser is still using.\n\nThe fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where\nlibrsvg will no longer free xmlEntity pointers that libxml2 is still\nusing.",
"id": "GHSA-cpvr-w4j5-2mpg",
"modified": "2026-10-22T15:52:48Z",
"published": "2026-10-22T15:52:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96889"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/commit/0bc935e675947e185d42005d3ad93d7cf61bcea9"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/commit/1606574427408baca8203ef723281509a229f9e2"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/commit/4d0051a9dbd038a5fe8461b61486677d88f8736d"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/commit/e56cc8a33a7184eef6e8a720414aee6205a400ad"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1211"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504"
},
{
"type": "PACKAGE",
"url": "https://gitlab.gnome.org/GNOME/librsvg"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/releases/tag/2.63.2"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/releases/tag/2.62.4"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/releases/tag/2.61.5"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/releases/tag/2.60.3"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/releases/tag/2.57.5"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/librsvg/blob/2.63.2/NEWS"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-96889"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:86921"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:86842"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:86841"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:86331"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Librsvg: Use-after-free when XML includes have duplicated entities"
}
GHSA-CPWF-RJ72-CFWC
Vulnerability from github – Published: 2022-11-09 12:00 – Updated: 2022-11-09 19:02Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritten space in memory. The accessed memory must be filled with code to execute the attack. Therefore, repeated success is unlikely.Stack-based buffer overflow. Since the memory overwritten is random, based on access rights of the memory, repeated success is not assured.
{
"affected": [],
"aliases": [
"CVE-2022-41211"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-416",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-08T22:15:00Z",
"severity": "HIGH"
},
"details": "Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritten space in memory. The accessed memory must be filled with code to execute the attack. Therefore, repeated success is unlikely.Stack-based buffer overflow. Since the memory overwritten is random, based on access rights of the memory, repeated success is not assured.",
"id": "GHSA-cpwf-rj72-cfwc",
"modified": "2022-11-09T19:02:23Z",
"published": "2022-11-09T12:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41211"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3263436"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPWQ-WFH7-JF75
Vulnerability from github – Published: 2026-05-06 21:31 – Updated: 2026-05-07 01:05Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-7940"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T19:16:42Z",
"severity": "HIGH"
},
"details": "Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)",
"id": "GHSA-cpwq-wfh7-jf75",
"modified": "2026-05-07T01:05:51Z",
"published": "2026-05-06T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7940"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/493631402"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.