CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
10231 vulnerabilities reference this CWE, most recent first.
GHSA-F593-X5JJ-V2PG
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-11 09:30In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix use-after-free race in VM acquire
Replace non-atomic vm->process_info assignment with cmpxchg() to prevent race when parent/child processes sharing a drm_file both try to acquire the same VM after fork().
(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
{
"affected": [],
"aliases": [
"CVE-2026-43370"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T15:16:48Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix use-after-free race in VM acquire\n\nReplace non-atomic vm-\u003eprocess_info assignment with cmpxchg()\nto prevent race when parent/child processes sharing a drm_file\nboth try to acquire the same VM after fork().\n\n(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)",
"id": "GHSA-f593-x5jj-v2pg",
"modified": "2026-05-11T09:30:30Z",
"published": "2026-05-08T15:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43370"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e61e355cbe49e585097eee28c15b862bfb1c0668"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5CJ-2GHC-VGWM
Vulnerability from github – Published: 2023-04-10 21:30 – Updated: 2023-04-15 00:30An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2023-26495"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-10T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.",
"id": "GHSA-f5cj-2ghc-vgwm",
"modified": "2023-04-15T00:30:36Z",
"published": "2023-04-10T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26495"
},
{
"type": "WEB",
"url": "https://www.opendesign.com/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5H4-685P-R266
Vulnerability from github – Published: 2024-10-21 15:32 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/qm - inject error before stopping queue
The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.
{
"affected": [],
"aliases": [
"CVE-2024-47730"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T13:15:03Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory.",
"id": "GHSA-f5h4-685p-r266",
"modified": "2025-11-04T00:31:38Z",
"published": "2024-10-21T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47730"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/801d64177faaec184cee1e1aa4d8487df1364a54"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/85e81103033324d7a271dafb584991da39554a89"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/98d3be34c9153eceadb56de50d9f9347e88d86e4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aa3e0db35a60002fb34ef0e4ad203aa59fd00203"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b04f06fc0243600665b3b50253869533b7938468"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8024f12752e32ffbbf59e1c09d949f977ff743f"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5JQ-H2M4-M9V7
Vulnerability from github – Published: 2022-10-15 12:01 – Updated: 2022-10-15 12:01Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2022-38447"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-14T20:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-f5jq-h2m4-m9v7",
"modified": "2022-10-15T12:01:01Z",
"published": "2022-10-15T12:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38447"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/dimension/apsb22-57.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5M3-MRHF-6CQV
Vulnerability from github – Published: 2026-06-12 00:31 – Updated: 2026-06-12 03:31Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-12028"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-11T22:16:55Z",
"severity": "HIGH"
},
"details": "Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-f5m3-mrhf-6cqv",
"modified": "2026-06-12T03:31:28Z",
"published": "2026-06-12T00:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12028"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/517555461"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5P6-VMGQ-F9QW
Vulnerability from github – Published: 2025-04-08 18:34 – Updated: 2025-04-08 18:34Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-29792"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T18:16:05Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-f5p6-vmgq-f9qw",
"modified": "2025-04-08T18:34:56Z",
"published": "2025-04-08T18:34:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29792"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29792"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5Q3-G3JG-VWQG
Vulnerability from github – Published: 2022-08-29 20:06 – Updated: 2022-09-03 00:00Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
{
"affected": [],
"aliases": [
"CVE-2021-41783"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-29T05:15:00Z",
"severity": "HIGH"
},
"details": "Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.",
"id": "GHSA-f5q3-g3jg-vwqg",
"modified": "2022-09-03T00:00:25Z",
"published": "2022-08-29T20:06:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41783"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5QM-FXVW-FWJG
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2023-12-27 18:30A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
{
"affected": [],
"aliases": [
"CVE-2020-35512"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-15T17:15:00Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors",
"id": "GHSA-f5qm-fxvw-fwjg",
"modified": "2023-12-27T18:30:19Z",
"published": "2022-05-24T17:42:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35512"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/755392"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5QR-CHHP-9G8P
Vulnerability from github – Published: 2022-05-17 03:08 – Updated: 2022-05-17 03:08Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, and CVE-2015-3059.
{
"affected": [],
"aliases": [
"CVE-2015-3075"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-05-13T11:00:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, and CVE-2015-3059.",
"id": "GHSA-f5qr-chhp-9g8p",
"modified": "2022-05-17T03:08:03Z",
"published": "2022-05-17T03:08:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3075"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/reader/apsb15-10.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74602"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032284"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F5RX-X946-JM33
Vulnerability from github – Published: 2022-05-02 06:15 – Updated: 2026-05-20 18:31Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-0806"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-10T22:30:00Z",
"severity": "HIGH"
},
"details": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\"",
"id": "GHSA-f5rx-x946-jm33",
"modified": "2026-05-20T18:31:28Z",
"published": "2022-05-02T06:15:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0806"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772"
},
{
"type": "WEB",
"url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806"
},
{
"type": "WEB",
"url": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx"
},
{
"type": "WEB",
"url": "http://osvdb.org/62810"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38860"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/744549"
},
{
"type": "WEB",
"url": "http://www.microsoft.com/technet/security/advisory/981374.mspx"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38615"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/0567"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/0744"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.