Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12291 vulnerabilities reference this CWE, most recent first.
GHSA-GP5V-JG37-FVG6
Vulnerability from github – Published: 2026-07-08 03:30 – Updated: 2026-07-08 03:30
VLAI
Details
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Severity
7.7 (High)
{
"affected": [],
"aliases": [
"CVE-2026-60002"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T01:16:29Z",
"severity": "HIGH"
},
"details": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
"id": "GHSA-gp5v-jg37-fvg6",
"modified": "2026-07-08T03:30:27Z",
"published": "2026-07-08T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
},
{
"type": "WEB",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"type": "WEB",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GP6R-24H3-QCJV
Vulnerability from github – Published: 2023-11-19 12:30 – Updated: 2024-02-22 12:30
VLAI
Details
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-5341"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-19T10:15:49Z",
"severity": "MODERATE"
},
"details": "A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.",
"id": "GHSA-gp6r-24h3-qcjv",
"modified": "2024-02-22T12:30:54Z",
"published": "2023-11-19T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5341"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5341"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241774"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LICYTADFJAFPZW3Y2MKNCJIUYODPAG4L"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAULDP3GG5KI3XITQ5XSMRSILCBZS2VK"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GP73-FFFP-QJWC
Vulnerability from github – Published: 2026-10-21 00:32 – Updated: 2026-10-21 00:32
VLAI
Details
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-113210"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T22:19:14Z",
"severity": "HIGH"
},
"details": "Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-gp73-fffp-qjwc",
"modified": "2026-10-21T00:32:46Z",
"published": "2026-10-21T00:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113210"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/563354824"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GP9W-GXWQ-V39F
Vulnerability from github – Published: 2026-10-13 21:33 – Updated: 2026-10-13 21:33
VLAI
Details
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-108460"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:18:05Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.",
"id": "GHSA-gp9w-gxwq-v39f",
"modified": "2026-10-13T21:33:28Z",
"published": "2026-10-13T21:33:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108460"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108460"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPC5-JCFF-GVG6
Vulnerability from github – Published: 2026-10-13 21:36 – Updated: 2026-10-13 21:36
VLAI
Details
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-88134"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:21:32Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-gpc5-jcff-gvg6",
"modified": "2026-10-13T21:36:41Z",
"published": "2026-10-13T21:36:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88134"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPCH-93VR-H37R
Vulnerability from github – Published: 2026-10-21 00:32 – Updated: 2026-10-21 00:32
VLAI
Details
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-113033"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T22:18:54Z",
"severity": "HIGH"
},
"details": "Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-gpch-93vr-h37r",
"modified": "2026-10-21T00:32:39Z",
"published": "2026-10-21T00:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113033"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/499869964"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPFH-JVF9-7WG5
Vulnerability from github – Published: 2021-11-10 18:51 – Updated: 2024-11-07 22:12
VLAI
Summary
Use after free / memory leak in `CollectiveReduceV2`
Details
Impact
The async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free:
import tensorflow as tf
tf.raw_ops.CollectiveReduceV2(
input=[],
group_size=[-10, -10, -10],
group_key=[-10, -10],
instance_key=[-10],
ordering_token=[],
merge_op='Mul',
final_op='Div')
This occurs due to the asynchronous computation and the fact that objects that have been std::move()d from are still accessed:
auto done_with_cleanup = [col_params, done = std::move(done)]() {
done();
col_params->Unref();
};
OP_REQUIRES_OK_ASYNC(c,
FillCollectiveParams(col_params, REDUCTION_COLLECTIVE,
/*group_size*/ c->input(1),
/*group_key*/ c->input(2),
/*instance_key*/ c->input(3)),
done);
Here, done is already moved from by the time OP_REQUIRES_OK_ASYNC macro needs to invoke it in case of errors. In this case, we get an undefined behavior, which can manifest via crashes, std::bad_alloc throws or just memory leaks.
Patches
We have patched the issue in GitHub commit ca38dab9d3ee66c5de06f11af9a4b1200da5ef75.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6.0"
]
}
],
"aliases": [
"CVE-2021-41220"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-08T22:07:11Z",
"nvd_published_at": "2021-11-05T23:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nThe [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:\n\n```python\nimport tensorflow as tf\n \ntf.raw_ops.CollectiveReduceV2(\n input=[],\n group_size=[-10, -10, -10],\n group_key=[-10, -10],\n instance_key=[-10],\n ordering_token=[],\n merge_op=\u0027Mul\u0027,\n final_op=\u0027Div\u0027)\n``` \n\nThis occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed:\n\n```cc\nauto done_with_cleanup = [col_params, done = std::move(done)]() {\n done();\n col_params-\u003eUnref();\n};\nOP_REQUIRES_OK_ASYNC(c,\n FillCollectiveParams(col_params, REDUCTION_COLLECTIVE,\n /*group_size*/ c-\u003einput(1),\n /*group_key*/ c-\u003einput(2),\n /*instance_key*/ c-\u003einput(3)),\n done);\n```\n\nHere, `done` is already moved from by the time `OP_REQUIRES_OK_ASYNC` macro needs to invoke it in case of errors. In this case, we get an undefined behavior, which can manifest via crashes, `std::bad_alloc` throws or just memory leaks.\n\n### Patches\nWe have patched the issue in GitHub commit [ca38dab9d3ee66c5de06f11af9a4b1200da5ef75](https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75).\n\nThe fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.\n",
"id": "GHSA-gpfh-jvf9-7wg5",
"modified": "2024-11-07T22:12:03Z",
"published": "2021-11-10T18:51:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41220"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-629.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-827.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-412.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/tensorflow/tensorflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Use after free / memory leak in `CollectiveReduceV2`"
}
GHSA-GPGJ-GWJP-8VM9
Vulnerability from github – Published: 2026-06-12 00:31 – Updated: 2026-06-12 03:31
VLAI
Details
Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Severity
8.3 (High)
{
"affected": [],
"aliases": [
"CVE-2026-12023"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-11T22:16:54Z",
"severity": "HIGH"
},
"details": "Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-gpgj-gwjp-8vm9",
"modified": "2026-06-12T03:31:28Z",
"published": "2026-06-12T00:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12023"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/517018374"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPHQ-FWM7-X5G2
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-05-24 17:22
VLAI
Details
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-12416"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-09T15:15:00Z",
"severity": "HIGH"
},
"details": "A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox \u003c 78.",
"id": "GHSA-gphq-fwm7-x5g2",
"modified": "2022-05-24T17:22:39Z",
"published": "2022-05-24T17:22:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12416"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1639734"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-10"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-24"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPHW-QHQ6-J698
Vulnerability from github – Published: 2026-10-13 21:33 – Updated: 2026-10-13 21:33
VLAI
Details
Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
Severity
7.0 (High)
{
"affected": [],
"aliases": [
"CVE-2026-69964"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:19:06Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-gphw-qhq6-j698",
"modified": "2026-10-13T21:33:56Z",
"published": "2026-10-13T21:33:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69964"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69964"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.