CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12226 vulnerabilities reference this CWE, most recent first.
GHSA-FCHQ-4VH7-VRJV
Vulnerability from github – Published: 2024-04-02 21:30 – Updated: 2024-04-02 21:30Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22821.
{
"affected": [],
"aliases": [
"CVE-2024-30358"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T21:15:48Z",
"severity": "HIGH"
},
"details": "Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22821.",
"id": "GHSA-fchq-4vh7-vrjv",
"modified": "2024-04-02T21:30:30Z",
"published": "2024-04-02T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30358"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-330"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCJQ-FFHG-M7HF
Vulnerability from github – Published: 2026-09-15 15:32 – Updated: 2026-09-20 03:30Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
{
"affected": [],
"aliases": [
"CVE-2026-92029"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T13:16:54Z",
"severity": "HIGH"
},
"details": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.",
"id": "GHSA-fcjq-ffhg-m7hf",
"modified": "2026-09-20T03:30:23Z",
"published": "2026-09-15T15:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92029"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068445"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-90"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-91"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-92"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-93"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-94"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-95"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-96"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCM2-QHF9-7WVV
Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:24In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340350.
{
"affected": [],
"aliases": [
"CVE-2023-20849"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-04T03:15:11Z",
"severity": "MODERATE"
},
"details": "In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340350.",
"id": "GHSA-fcm2-qhf9-7wvv",
"modified": "2024-04-04T07:24:57Z",
"published": "2023-09-04T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20849"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/September-2023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCP5-2WFM-XFHH
Vulnerability from github – Published: 2022-04-06 00:01 – Updated: 2022-04-09 00:00Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2022-0453"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-05T01:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.",
"id": "GHSA-fcp5-2wfm-xfhh",
"modified": "2022-04-09T00:00:32Z",
"published": "2022-04-06T00:01:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0453"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1284916"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCP5-X2W7-M64H
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-61842"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T19:15:36Z",
"severity": "MODERATE"
},
"details": "Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-fcp5-x2w7-m64h",
"modified": "2025-11-11T21:30:27Z",
"published": "2025-11-11T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61842"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/formatplugins/apsb25-114.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FCPF-2C9P-9W89
Vulnerability from github – Published: 2026-09-04 03:31 – Updated: 2026-09-08 15:31Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption.
Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.
{
"affected": [],
"aliases": [
"CVE-2026-45200"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T02:17:19Z",
"severity": "HIGH"
},
"details": "Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption.\n\n\n\nScenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.",
"id": "GHSA-fcpf-2c9p-9w89",
"modified": "2026-09-08T15:31:34Z",
"published": "2026-09-04T03:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45200"
},
{
"type": "WEB",
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCV3-4H5F-37C2
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:31In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: Fix use after free in debug code
We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.
{
"affected": [],
"aliases": [
"CVE-2026-63927"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:11Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: Fix use after free in debug code\n\nWe\u0027re not allowed to dereference \"urb\" after calling\nusb_hcd_giveback_urb() so save the urb-\u003estatus ahead of time.",
"id": "GHSA-fcv3-4h5f-37c2",
"modified": "2026-07-20T15:31:52Z",
"published": "2026-07-19T18:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63927"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0584af4fe40fa5e254a05d69ce658746de641708"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/63b0dafa676aad4d0c3f01a61ad8e2990907660c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d0b79d1d1118145e48a68192b6d733e39387053"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84ea928ed584756e59c6ac09736f12d1db95ded0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9ea06a3fbf9f16e0d98c52cb3b99642be15ec281"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a15eeeceb94cbc04edef395e4d777ff554bdc27d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d5fc183ed614aeba6779cc992325be560f9a4451"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCW9-VWJP-9J4V
Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-10-15 03:36In the Linux kernel, the following vulnerability has been resolved:
sctp: diag: reject stale associations in dump_one path
The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list.
When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() can still dereference association state that is no longer valid for reporting. In particular, inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a real sctp_sockaddr_entry and trigger an out-of-bounds read from unrelated association memory.
Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state.
{
"affected": [],
"aliases": [
"CVE-2026-52917"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T08:16:21Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: diag: reject stale associations in dump_one path\n\nThe SCTP exact sock_diag lookup can hold a transport reference, block on\nlock_sock(sk), and then resume after sctp_association_free() has marked\nthe association dead and freed its bind address list.\n\nWhen that happens, inet_assoc_attr_size() and\ninet_diag_msg_sctpasoc_fill() can still dereference association state\nthat is no longer valid for reporting. In particular,\ninet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a\nreal sctp_sockaddr_entry and trigger an out-of-bounds read from\nunrelated association memory.\n\nReject the association after taking the socket lock if it has been\nreaped or detached from the endpoint, and report the lookup as stale.\nThis keeps the exact dump-one path from formatting torn association\nstate.",
"id": "GHSA-fcw9-vwjp-9j4v",
"modified": "2026-10-15T03:36:09Z",
"published": "2026-06-24T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52917"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/480f754580b5686b928977d16a59f20cef83ff01"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5425de8bd6e9fe5bd67d158e3348171ae7510117"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5eba3e48d78edd7551b992cb7ba687019b3a78da"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6657af827e21883ae90693e42e7f59a6aab690b5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/78c4f964b2f94e405721c093773f6250e1e676b2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b2be72d401833194917e44fbd8d8144bb4f2db16"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e97c2a535e23ed0fdd2660993fb3f10d9535c9bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f5af203dec6e0e7a6090fcc2130e9f3901bfc84d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCWW-W53C-CMPF
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21086.
{
"affected": [],
"aliases": [
"CVE-2023-34294"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T02:15:29Z",
"severity": "LOW"
},
"details": "Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21086.",
"id": "GHSA-fcww-w53c-cmpf",
"modified": "2024-05-03T03:30:52Z",
"published": "2024-05-03T03:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34294"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-853"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FF4P-GM2H-8JJ9
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Sound annotations. By manipulating a document's elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6217.
{
"affected": [],
"aliases": [
"CVE-2018-14301"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-31T20:29:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Sound annotations. By manipulating a document\u0027s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6217.",
"id": "GHSA-ff4p-gm2h-8jj9",
"modified": "2022-05-13T01:34:34Z",
"published": "2022-05-13T01:34:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14301"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "https://zerodayinitiative.com/advisories/ZDI-18-761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.