CWE-763
AllowedRelease of Invalid Pointer or Reference
Abstraction: Base · Status: Incomplete
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
142 vulnerabilities reference this CWE, most recent first.
GHSA-RFHM-HWP6-XRR6
Vulnerability from github – Published: 2026-09-08 03:31 – Updated: 2026-09-08 03:31Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
{
"affected": [],
"aliases": [
"CVE-2026-16005"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T03:17:17Z",
"severity": "MODERATE"
},
"details": "Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver\u0027s verification, which can corrupt data structures and cause a system crash (BSOD).Refer to the \u0027\nSecurity Update for Armoury Crate App\u00a0\u00a0\u0027 section on the ASUS Security Advisory for more information.",
"id": "GHSA-rfhm-hwp6-xrr6",
"modified": "2026-09-08T03:31:14Z",
"published": "2026-09-08T03:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16005"
},
{
"type": "WEB",
"url": "https://www.asus.com/security-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RJ76-WCHJ-2F64
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-10-07 21:33In the Linux kernel, the following vulnerability has been resolved:
ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
The goto err label leads to:
genlmsg_cancel(skb, ehdr);
return ret;
If ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg. There's nothing to cancel, and passing an error pointer to genlmsg_cancel() would cause a crash.
{
"affected": [],
"aliases": [
"CVE-2026-63986"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:17Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: tsinfo: don\u0027t pass ERR_PTR to genlmsg_cancel on prepare failure\n\nThe goto err label leads to:\n\n\tgenlmsg_cancel(skb, ehdr);\n\treturn ret;\n\nIf ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg.\nThere\u0027s nothing to cancel, and passing an error pointer to\ngenlmsg_cancel() would cause a crash.",
"id": "GHSA-rj76-wchj-2f64",
"modified": "2026-10-07T21:33:17Z",
"published": "2026-07-19T18:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63986"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2008f9bb1ede9b688624a241228b8e54fc74f0f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c3fc9976f686f9a95baf87db9d387f218fd65394"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d0d2c5ccd1de28368cebeef74d9c530a60eff9a5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJJF-4C46-J276
Vulnerability from github – Published: 2026-10-13 21:37 – Updated: 2026-10-13 21:37Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2026-97011"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:22:10Z",
"severity": "HIGH"
},
"details": "Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.",
"id": "GHSA-rjjf-4c46-j276",
"modified": "2026-10-13T21:37:10Z",
"published": "2026-10-13T21:37:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97011"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4V8-WM34-Q82P
Vulnerability from github – Published: 2026-10-13 21:34 – Updated: 2026-10-13 21:34Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-83735"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:20:18Z",
"severity": "HIGH"
},
"details": "Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-v4v8-wm34-q82p",
"modified": "2026-10-13T21:34:45Z",
"published": "2026-10-13T21:34:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83735"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83735"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VC92-X84F-VM43
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2025-10-03 18:31In the Linux kernel, the following vulnerability has been resolved:
kunit/fortify: Fix mismatched kvalloc()/vfree() usage
The kv*() family of tests were accidentally freeing with vfree() instead of kvfree(). Use kvfree() instead.
{
"affected": [],
"aliases": [
"CVE-2024-38617"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T14:15:21Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/fortify: Fix mismatched kvalloc()/vfree() usage\n\nThe kv*() family of tests were accidentally freeing with vfree() instead\nof kvfree(). Use kvfree() instead.",
"id": "GHSA-vc92-x84f-vm43",
"modified": "2025-10-03T18:31:18Z",
"published": "2024-06-19T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38617"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VQJC-5C88-XV3G
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-10-07 18:31In the Linux kernel, the following vulnerability has been resolved:
efi/libstub: Free correct pointer on failure
cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack.
cmdline refers to the pool allocation that should be freed when cleaning up after a failure, so pass this instead to free_pool().
{
"affected": [],
"aliases": [
"CVE-2024-56573"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T15:15:16Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/libstub: Free correct pointer on failure\n\ncmdline_ptr is an out parameter, which is not allocated by the function\nitself, and likely points into the caller\u0027s stack.\n\ncmdline refers to the pool allocation that should be freed when cleaning\nup after a failure, so pass this instead to free_pool().",
"id": "GHSA-vqjc-5c88-xv3g",
"modified": "2025-10-07T18:31:02Z",
"published": "2024-12-27T15:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56573"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W4H7-3HCX-QGV6
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl::~SmallVectorImpl.
{
"affected": [],
"aliases": [
"CVE-2020-36404"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-01T03:15:00Z",
"severity": "HIGH"
},
"details": "Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl\u003cllvm_ks::MCFixup\u003e::~SmallVectorImpl.",
"id": "GHSA-w4h7-3hcx-qgv6",
"modified": "2022-05-24T19:06:45Z",
"published": "2022-05-24T19:06:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36404"
},
{
"type": "WEB",
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371"
},
{
"type": "WEB",
"url": "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-1506.yaml"
},
{
"type": "WEB",
"url": "https://github.com/keystone-engine/keystone/releases"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W77P-R8H7-VHQG
Vulnerability from github – Published: 2026-10-13 21:36 – Updated: 2026-10-13 21:36Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-85850"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:21:11Z",
"severity": "HIGH"
},
"details": "Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-w77p-r8h7-vhqg",
"modified": "2026-10-13T21:36:06Z",
"published": "2026-10-13T21:36:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85850"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85850"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W833-PX7J-Q64C
Vulnerability from github – Published: 2023-10-19 12:30 – Updated: 2024-04-04 08:47The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.
{
"affected": [],
"aliases": [
"CVE-2022-26942"
],
"database_specific": {
"cwe_ids": [
"CWE-763",
"CWE-822"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-19T10:15:09Z",
"severity": "HIGH"
},
"details": "The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. ",
"id": "GHSA-w833-px7j-q64c",
"modified": "2024-04-04T08:47:34Z",
"published": "2023-10-19T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26942"
},
{
"type": "WEB",
"url": "https://tetraburst.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WG63-8XJW-5WVX
Vulnerability from github – Published: 2022-06-17 00:01 – Updated: 2022-06-28 00:00In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-31625"
],
"database_specific": {
"cwe_ids": [
"CWE-763"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-16T06:15:00Z",
"severity": "CRITICAL"
},
"details": "In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.",
"id": "GHSA-wg63-8xjw-5wvx",
"modified": "2022-06-28T00:00:55Z",
"published": "2022-06-17T00:01:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31625"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=81720"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202209-20"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220722-0005"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5179"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
Mitigation
When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
Mitigation MIT-4.6
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, glibc in Linux provides protection against free of invalid pointers.
Mitigation
Use a language that provides abstractions for memory allocation and deallocation.
No CAPEC attack patterns related to this CWE.