CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12489 vulnerabilities reference this CWE, most recent first.
GHSA-J82Q-4X2P-MXP4
Vulnerability from github – Published: 2026-11-02 03:30 – Updated: 2026-11-02 18:32In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752.
{
"affected": [],
"aliases": [
"CVE-2026-20580"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-02T03:17:35Z",
"severity": "MODERATE"
},
"details": "In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752.",
"id": "GHSA-j82q-4x2p-mxp4",
"modified": "2026-11-02T18:32:19Z",
"published": "2026-11-02T03:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20580"
},
{
"type": "WEB",
"url": "https://www.mediatek.com/product-security-bulletin/November-2026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J83W-4J6Q-7RXP
Vulnerability from github – Published: 2022-05-14 01:57 – Updated: 2022-05-14 01:57Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.
{
"affected": [],
"aliases": [
"CVE-2018-6054"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-25T14:29:00Z",
"severity": "HIGH"
},
"details": "Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.",
"id": "GHSA-j83w-4j6q-7rxp",
"modified": "2022-05-14T01:57:53Z",
"published": "2022-05-14T01:57:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0265"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html"
},
{
"type": "WEB",
"url": "https://crbug.com/797511"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4103"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102797"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040282"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J84J-RVVF-PMCM
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
{
"affected": [],
"aliases": [
"CVE-2025-59221"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:16:02Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.",
"id": "GHSA-j84j-rvvf-pmcm",
"modified": "2025-10-14T18:30:34Z",
"published": "2025-10-14T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59221"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59221"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J84V-78J2-55GH
Vulnerability from github – Published: 2025-05-27 21:32 – Updated: 2025-11-03 21:33Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2025-5283"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-27T21:15:23Z",
"severity": "MODERATE"
},
"details": "Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-j84v-78j2-55gh",
"modified": "2025-11-03T21:33:58Z",
"published": "2025-05-27T21:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5283"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/419467315"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00052.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J855-4985-FGJ7
Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 15:33Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-19171"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T22:16:59Z",
"severity": "CRITICAL"
},
"details": "Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-j855-4985-fgj7",
"modified": "2026-08-07T15:33:12Z",
"published": "2026-08-07T00:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19171"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/537832446"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J85C-4FRX-F93R
Vulnerability from github – Published: 2024-11-12 18:30 – Updated: 2024-11-12 18:30Microsoft SQL Server Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-49021"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T18:15:42Z",
"severity": "HIGH"
},
"details": "Microsoft SQL Server Remote Code Execution Vulnerability",
"id": "GHSA-j85c-4frx-f93r",
"modified": "2024-11-12T18:30:59Z",
"published": "2024-11-12T18:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49021"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49021"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J864-W7VW-6XG3
Vulnerability from github – Published: 2026-07-01 00:34 – Updated: 2026-07-01 18:31Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-13878"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T23:17:02Z",
"severity": "CRITICAL"
},
"details": "Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-j864-w7vw-6xg3",
"modified": "2026-07-01T18:31:31Z",
"published": "2026-07-01T00:34:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13878"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/499007266"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J86X-F498-4JQP
Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-10-30 15:33In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: unregister sysctl before tearing down listen socket
rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk.
KASAN reports the race as:
BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c
Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.
{
"affected": [],
"aliases": [
"CVE-2026-68290"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T13:20:18Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn-\u003erds_tcp_listen_sock-\u003esk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.",
"id": "GHSA-j86x-f498-4jqp",
"modified": "2026-10-30T15:33:00Z",
"published": "2026-08-10T15:33:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68290"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66fd678eef1bc2862bde5e7a0f6106256de74f30"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J879-HG9W-V5QV
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2022-05-24 17:09In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
{
"affected": [],
"aliases": [
"CVE-2020-9273"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-20T16:15:00Z",
"severity": "HIGH"
},
"details": "In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.",
"id": "GHSA-j879-hg9w-v5qv",
"modified": "2022-05-24T17:09:25Z",
"published": "2022-05-24T17:09:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9273"
},
{
"type": "WEB",
"url": "https://github.com/proftpd/proftpd/issues/903"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf"
},
{
"type": "WEB",
"url": "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00022.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCUPRYSJR7XOM3HQ6H5M4OGDU7OHCHBF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHO3S5WPRRP7VGKIAHLYQVEYW5HRYIJN"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-35"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4635"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/08/25/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/09/06/2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J87H-FMF7-GRWW
Vulnerability from github – Published: 2026-10-21 00:32 – Updated: 2026-10-21 00:32Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-113113"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T22:19:03Z",
"severity": "HIGH"
},
"details": "Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-j87h-fmf7-grww",
"modified": "2026-10-21T00:32:42Z",
"published": "2026-10-21T00:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113113"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/495899355"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.