CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12249 vulnerabilities reference this CWE, most recent first.
GHSA-FMP8-Q8MQ-WM2X
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-10-03 12:31In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix transaction use-after-free in raid stripe insertion
If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM.
btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again.
The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller's second abort accesses the handle and transaction, resulting in use-after-free.
Keep the abort at the failure site, but let the caller's common exit path end the transaction once, after it has finished using both objects.
{
"affected": [],
"aliases": [
"CVE-2026-98083"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:37Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction use-after-free in raid stripe insertion\n\nIf allocation of a RAID stripe extent fails,\nbtrfs_insert_one_raid_extent() aborts and ends the transaction before\nreturning -ENOMEM.\n\nbtrfs_finish_one_ordered(), the production caller through\nbtrfs_insert_raid_extent(), still owns the transaction handle. It handles\nthe error by aborting the transaction and then reaches the common exit\npath, which ends the transaction again.\n\nThe premature end can free the handle and drop its transaction reference.\nTransaction cleanup can then free the transaction before the caller\u0027s\nsecond abort accesses the handle and transaction, resulting in\nuse-after-free.\n\nKeep the abort at the failure site, but let the caller\u0027s common exit path\nend the transaction once, after it has finished using both objects.",
"id": "GHSA-fmp8-q8mq-wm2x",
"modified": "2026-10-03T12:31:26Z",
"published": "2026-09-25T12:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98083"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/089d9c45ea49ffffe55a8fe08d0ce2536626e90a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a8813a923f9e43f788b357fb55c35f7f6ed6f98c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b185bdf30313e213fa1c887fe22fc3d513c061d9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMQ5-3RP8-8HQP
Vulnerability from github – Published: 2026-10-13 21:34 – Updated: 2026-10-13 21:34Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-70067"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:19:17Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-fmq5-3rp8-8hqp",
"modified": "2026-10-13T21:34:02Z",
"published": "2026-10-13T21:34:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70067"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70067"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMVF-422W-W34Q
Vulnerability from github – Published: 2026-04-15 21:30 – Updated: 2026-04-16 12:31Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-6318"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-15T20:16:42Z",
"severity": "HIGH"
},
"details": "Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-fmvf-422w-w34q",
"modified": "2026-04-16T12:31:40Z",
"published": "2026-04-15T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6318"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/495996858"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMVQ-PH7G-PQ3C
Vulnerability from github – Published: 2022-05-14 01:34 – Updated: 2022-05-14 01:34In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Heap memory was accessed after it was freed
{
"affected": [],
"aliases": [
"CVE-2018-13889"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-11T15:29:00Z",
"severity": "HIGH"
},
"details": "In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Heap memory was accessed after it was freed",
"id": "GHSA-fmvq-ph7g-pq3c",
"modified": "2022-05-14T01:34:57Z",
"published": "2022-05-14T01:34:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13889"
},
{
"type": "WEB",
"url": "https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletin"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106496"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMVX-5HVP-Q7FH
Vulnerability from github – Published: 2025-04-03 09:32 – Updated: 2025-11-03 21:33In the Linux kernel, the following vulnerability has been resolved:
net: atm: fix use after free in lec_send()
The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
{
"affected": [],
"aliases": [
"CVE-2025-22004"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix use after free in lec_send()\n\nThe -\u003esend() operation frees skb so save the length before calling\n-\u003esend() to avoid a use after free.",
"id": "GHSA-fmvx-5hvp-q7fh",
"modified": "2025-11-03T21:33:30Z",
"published": "2025-04-03T09:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22004"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/326223182e4703cde99fdbd36d07d0b3de9980fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/50e288097c2c6e5f374ae079394436fc29d1e88e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51e8be9578a2e74f9983d8fd8de8cafed191f30c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82d9084a97892de1ee4881eb5c17911fcd9be6f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8cd90c7db08f32829bfa1b5b2b11fbc542afbab7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9566f6ee13b17a15d0a47667ad1b1893c539f730"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f3009d0d6ab78053117f8857b921a8237f4d17b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f3271f7548385e0096739965961c7cbf7e6b4762"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMWH-MR5J-P6WQ
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-09-03 18:31In the Linux kernel, the following vulnerability has been resolved:
USB: ldusb: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
{
"affected": [],
"aliases": [
"CVE-2026-64343"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:16Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")",
"id": "GHSA-fmwh-mr5j-p6wq",
"modified": "2026-09-03T18:31:17Z",
"published": "2026-07-25T12:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64343"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMWH-V9R8-W9J6
Vulnerability from github – Published: 2026-03-31 12:31 – Updated: 2026-03-31 12:31An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-27854"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-31T12:16:28Z",
"severity": "MODERATE"
},
"details": "An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.",
"id": "GHSA-fmwh-v9r8-w9j6",
"modified": "2026-03-31T12:31:35Z",
"published": "2026-03-31T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27854"
},
{
"type": "WEB",
"url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FMXG-92J4-7RHR
Vulnerability from github – Published: 2025-11-07 00:30 – Updated: 2025-11-07 15:31Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2025-11756"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T23:15:35Z",
"severity": "HIGH"
},
"details": "Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-fmxg-92j4-7rhr",
"modified": "2025-11-07T15:31:30Z",
"published": "2025-11-07T00:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11756"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_14.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/447192722"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FP4C-F74P-8CG7
Vulnerability from github – Published: 2025-06-30 09:30 – Updated: 2025-11-19 15:31In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in taprio_dev_notifier
Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free.
Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
{
"affected": [],
"aliases": [
"CVE-2025-38087"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-30T08:15:22Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in taprio_dev_notifier\n\nSince taprio\u2019s taprio_dev_notifier() isn\u2019t protected by an\nRCU read-side critical section, a race with advance_sched()\ncan lead to a use-after-free.\n\nAdding rcu_read_lock() inside taprio_dev_notifier() prevents this.",
"id": "GHSA-fp4c-f74p-8cg7",
"modified": "2025-11-19T15:31:32Z",
"published": "2025-06-30T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38087"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a008c89e5e5c5332e4c0a33d707db9ddd529f8a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c5713ce1ced75f9e9ed5c642ea3d2ba06ead69c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b1547d28ba468bc3b88764efd13e4319bab63be8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b160766e26d4e2e2d6fe2294e0b02f92baefcec5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FP4X-MVC7-87CP
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the fillColor property of a TimeField. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6483.
{
"affected": [],
"aliases": [
"CVE-2018-17646"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-24T04:29:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the fillColor property of a TimeField. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6483.",
"id": "GHSA-fp4x-mvc7-87cp",
"modified": "2022-05-13T01:33:57Z",
"published": "2022-05-13T01:33:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17646"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-1156"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.