Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
10190 vulnerabilities reference this CWE, most recent first.
GHSA-9CP9-MWF2-V22F
Vulnerability from github – Published: 2024-08-05 15:30 – Updated: 2024-08-05 15:30
VLAI
Details
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2024-33023"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-05T15:15:51Z",
"severity": "HIGH"
},
"details": "Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.",
"id": "GHSA-9cp9-mwf2-v22f",
"modified": "2024-08-05T15:30:53Z",
"published": "2024-08-05T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33023"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CQQ-QVWP-6CPP
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18
VLAI
Details
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.
{
"affected": [],
"aliases": [
"CVE-2013-6646"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-01-16T12:17:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.",
"id": "GHSA-9cqq-qvwp-6cpp",
"modified": "2022-05-13T01:18:03Z",
"published": "2022-05-13T01:18:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6646"
},
{
"type": "WEB",
"url": "https://code.google.com/p/chromium/issues/detail?id=249502"
},
{
"type": "WEB",
"url": "https://src.chromium.org/viewvc/chrome?revision=233099\u0026view=revision"
},
{
"type": "WEB",
"url": "https://src.chromium.org/viewvc/chrome?revision=233367\u0026view=revision"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2862"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9CQQ-VC77-3HMQ
Vulnerability from github – Published: 2022-01-14 00:01 – Updated: 2022-01-15 00:02
VLAI
Details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14911.
{
"affected": [],
"aliases": [
"CVE-2021-34933"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-13T22:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14911.",
"id": "GHSA-9cqq-vc77-3hmq",
"modified": "2022-01-15T00:02:11Z",
"published": "2022-01-14T00:01:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34933"
},
{
"type": "WEB",
"url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1521"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9CQX-R2HG-7PGQ
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-04-11 03:56
VLAI
Details
Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it really doesn't matter if it's third-party code."
{
"affected": [],
"aliases": [
"CVE-2012-1845"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-03-22T16:55:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated \"it really doesn\u0027t matter if it\u0027s third-party code.\"",
"id": "GHSA-9cqx-r2hg-7pgq",
"modified": "2025-04-11T03:56:28Z",
"published": "2022-05-13T01:27:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1845"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74323"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14843"
},
{
"type": "WEB",
"url": "http://pwn2own.zerodayinitiative.com/status.html"
},
{
"type": "WEB",
"url": "http://twitter.com/vupen/statuses/177576000761237505"
},
{
"type": "WEB",
"url": "http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees"
},
{
"type": "WEB",
"url": "http://www.zdnet.com/blog/security/pwn2own-2012-google-chrome-browser-sandbox-first-to-fall/10588"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9CRJ-F8M2-WRGJ
Vulnerability from github – Published: 2022-05-17 02:24 – Updated: 2022-05-17 02:24
VLAI
Details
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-4487"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-24T20:59:00Z",
"severity": "MODERATE"
},
"details": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
"id": "GHSA-9crj-f8m2-wrgj",
"modified": "2022-05-17T02:24:42Z",
"published": "2022-05-17T02:24:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4487"
},
{
"type": "WEB",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/05/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/90025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CV6-QCJW-4GRX
Vulnerability from github – Published: 2026-06-19 20:47 – Updated: 2026-06-19 20:47
VLAI
Summary
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling
Details
Summary
Oj::Parser#parse in usual mode with create_id enabled is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process.
Version
- Software: oj gem
- Affected: all versions with
ext/oj/usual.c - Latest tested: 3.17.1 (confirmed present)
Details
ext/oj/usual.c, form_attr:
// usual.c:55–64
static ID form_attr(const char *str, size_t slen) {
char buf[4096];
// ...
int blen = (int)slen + 1; // ← truncates: 65535 + 1 = 65536 → wraps to 0
// or: 65535 cast to int = 65535 (fits),
// but blen = 65536 → INT overflow on +1 if slen=INT_MAX
// ...
memcpy(buf, "@", 1);
memcpy(buf + 1, str, (size_t)blen); // ← size_t(-1) = SIZE_MAX
}
The cache (cache_intern) uses a fixed 65,536-byte slab. When slen = 65535, the arithmetic wraps and memcpy is called with (size_t)-1.
ASAN report:
==80452==ERROR: AddressSanitizer: negative-size-param: (size=-1)
#0 memcpy
#1 form_attr /ext/oj/usual.c:63
#2 cache_intern /ext/oj/cache.c:326
#3 get_attr_id /ext/oj/usual.c:186
#4 close_object_create /ext/oj/usual.c:374
#5 parse /ext/oj/parser.c:693
#6 parser_parse /ext/oj/parser.c:1408
0x531000528800 is located 0 bytes inside of 65536-byte region [0x531000528800, 0x531000538800)
Reproduce
Generate the payload:
key = 'A' * 65535
with open('poc.json', 'w') as f:
f.write('{"json_class":"Oj::Bag","' + key + '":1}')
Trigger:
require 'oj'
Oj::Parser.new(:usual, create_id: 'json_class').parse(STDIN.read)
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.17.2"
},
"package": {
"ecosystem": "RubyGems",
"name": "oj"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.17.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54900"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T20:47:23Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\n`Oj::Parser#parse` in usual mode with `create_id` enabled is vulnerable to heap corruption via a negative-size `memcpy`. When a JSON object key is exactly 65,535 bytes long, an integer truncation in `form_attr` (`usual.c:63`) converts the length to `-1` before passing it to `memcpy`. This causes `memcpy` to copy `SIZE_MAX` bytes (interpreted as a huge `size_t`), corrupting heap memory and crashing the process.\n\n### Version\n\n- **Software**: oj gem\n- **Affected**: all versions with `ext/oj/usual.c`\n- **Latest tested**: 3.17.1 (confirmed present)\n\n### Details\n\n`ext/oj/usual.c`, `form_attr`:\n\n```c\n// usual.c:55\u201364\nstatic ID form_attr(const char *str, size_t slen) {\n char buf[4096];\n // ...\n int blen = (int)slen + 1; // \u2190 truncates: 65535 + 1 = 65536 \u2192 wraps to 0\n // or: 65535 cast to int = 65535 (fits),\n // but blen = 65536 \u2192 INT overflow on +1 if slen=INT_MAX\n // ...\n memcpy(buf, \"@\", 1);\n memcpy(buf + 1, str, (size_t)blen); // \u2190 size_t(-1) = SIZE_MAX\n}\n```\n\nThe cache (`cache_intern`) uses a fixed 65,536-byte slab. When `slen = 65535`, the arithmetic wraps and `memcpy` is called with `(size_t)-1`.\n\nASAN report:\n```\n==80452==ERROR: AddressSanitizer: negative-size-param: (size=-1)\n #0 memcpy\n #1 form_attr /ext/oj/usual.c:63\n #2 cache_intern /ext/oj/cache.c:326\n #3 get_attr_id /ext/oj/usual.c:186\n #4 close_object_create /ext/oj/usual.c:374\n #5 parse /ext/oj/parser.c:693\n #6 parser_parse /ext/oj/parser.c:1408\n0x531000528800 is located 0 bytes inside of 65536-byte region [0x531000528800, 0x531000538800)\n```\n\n### Reproduce\n\nGenerate the payload:\n\n```python\nkey = \u0027A\u0027 * 65535\nwith open(\u0027poc.json\u0027, \u0027w\u0027) as f:\n f.write(\u0027{\"json_class\":\"Oj::Bag\",\"\u0027 + key + \u0027\":1}\u0027)\n```\n\nTrigger:\n\n```ruby\nrequire \u0027oj\u0027\nOj::Parser.new(:usual, create_id: \u0027json_class\u0027).parse(STDIN.read)\n```",
"id": "GHSA-9cv6-qcjw-4grx",
"modified": "2026-06-19T20:47:23Z",
"published": "2026-06-19T20:47:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9cv6-qcjw-4grx"
},
{
"type": "PACKAGE",
"url": "https://github.com/ohler55/oj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling"
}
GHSA-9CW3-R74P-WGW5
Vulnerability from github – Published: 2026-07-30 18:31 – Updated: 2026-07-30 21:31
VLAI
Details
sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-51291"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T17:16:32Z",
"severity": "CRITICAL"
},
"details": "sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module.",
"id": "GHSA-9cw3-r74p-wgw5",
"modified": "2026-07-30T21:31:47Z",
"published": "2026-07-30T18:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51291"
},
{
"type": "WEB",
"url": "https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51291"
},
{
"type": "WEB",
"url": "https://github.com/sqlite/sqlite/blob/master/src/json.c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CWC-PF2G-QX32
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 18:31
VLAI
Details
Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Severity
9.6 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-11094"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:17:14Z",
"severity": "CRITICAL"
},
"details": "Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-9cwc-pf2g-qx32",
"modified": "2026-06-05T18:31:35Z",
"published": "2026-06-05T00:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11094"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/500174874"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9F2J-4QC4-329W
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-15 15:32
VLAI
Details
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-58613"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:18:44Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-9f2j-4qc4-329w",
"modified": "2026-07-15T15:32:53Z",
"published": "2026-07-14T18:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58613"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2426"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9F4G-PMFG-4P4Q
Vulnerability from github – Published: 2023-04-13 09:30 – Updated: 2024-04-04 03:26
VLAI
Details
Memory corruption due to use after free in Modem while modem initialization.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-33298"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-13T07:15:00Z",
"severity": "HIGH"
},
"details": "Memory corruption due to use after free in Modem while modem initialization.",
"id": "GHSA-9f4g-pmfg-4p4q",
"modified": "2024-04-04T03:26:04Z",
"published": "2023-04-13T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33298"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.