CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
9854 vulnerabilities reference this CWE, most recent first.
GHSA-3RCG-456G-86P6
Vulnerability from github – Published: 2025-05-20 18:30 – Updated: 2025-12-07 00:30In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in session logoff
The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for that connection could be in the smb2_sess_setup function which makes use of sess->user.
{
"affected": [],
"aliases": [
"CVE-2025-37899"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-20T16:15:26Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in session logoff\n\nThe sess-\u003euser object can currently be in use by another thread, for\nexample if another connection has sent a session setup request to\nbind to the session being free\u0027d. The handler for that connection could\nbe in the smb2_sess_setup function which makes use of sess-\u003euser.",
"id": "GHSA-3rcg-456g-86p6",
"modified": "2025-12-07T00:30:55Z",
"published": "2025-05-20T18:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37899"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02d16046cd11a5c037b28c12ffb818c56dd3ef43"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2fc9feff45d92a92cd5f96487655d5be23fb7e2b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/70ad6455139e26e85f48f95d0e21f351c1909342"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/931dc8a3670f71c45c0b1379ea4e92dafbda1aca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d5ec1d79509b3ee01de02c236f096bc050221b7f"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=44081338"
},
{
"type": "WEB",
"url": "https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RF3-8WMX-CM8Q
Vulnerability from github – Published: 2024-06-10 09:31 – Updated: 2025-10-22 00:33In the Linux kernel, the following vulnerability has been resolved:
net: fix __dst_negative_advice() race
__dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves.
Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
{
"affected": [],
"aliases": [
"CVE-2024-36971"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-10T09:15:09Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk-\u003edst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk-\u003esk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three -\u003enegative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets.",
"id": "GHSA-3rf3-8wmx-cm8q",
"modified": "2025-10-22T00:33:03Z",
"published": "2024-06-10T09:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36971"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RF9-JVJ9-2299
Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2022-05-13 01:05Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.
{
"affected": [],
"aliases": [
"CVE-2012-1180"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-04-17T21:55:00Z",
"severity": "MODERATE"
},
"details": "Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.",
"id": "GHSA-3rf9-jvj9-2299",
"modified": "2022-05-13T01:05:17Z",
"published": "2022-05-13T01:05:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1180"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=803856"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74191"
},
{
"type": "WEB",
"url": "https://hermes.opensuse.org/messages/14173096"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077966.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076646.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076671.html"
},
{
"type": "WEB",
"url": "http://nginx.org/download/patch.2012.memory.txt"
},
{
"type": "WEB",
"url": "http://nginx.org/en/security_advisories.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/80124"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2012/Mar/65"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48465"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48577"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201203-22.xml"
},
{
"type": "WEB",
"url": "http://trac.nginx.org/nginx/changeset/4530/nginx"
},
{
"type": "WEB",
"url": "http://trac.nginx.org/nginx/changeset/4531/nginx"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2434"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:043"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/03/15/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/03/15/9"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/52578"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1026827"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3RFF-RG87-9C8X
Vulnerability from github – Published: 2026-04-01 06:31 – Updated: 2026-04-01 15:31Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-5290"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T05:16:02Z",
"severity": "CRITICAL"
},
"details": "Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-3rff-rg87-9c8x",
"modified": "2026-04-01T15:31:15Z",
"published": "2026-04-01T06:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5290"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/496205576"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RFX-PJP7-CVFP
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2024-10-21 15:32During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93.
{
"affected": [],
"aliases": [
"CVE-2021-38496"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-03T01:15:00Z",
"severity": "HIGH"
},
"details": "During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 78.15, Thunderbird \u003c 91.2, Firefox ESR \u003c 91.2, Firefox ESR \u003c 78.15, and Firefox \u003c 93.",
"id": "GHSA-3rfx-pjp7-cvfp",
"modified": "2024-10-21T15:32:24Z",
"published": "2022-05-24T19:19:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38496"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1725335"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5034"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-43"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-46"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-47"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RH7-494Q-3MJQ
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:31A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
{
"affected": [],
"aliases": [
"CVE-2019-3817"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-27T13:29:01Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.",
"id": "GHSA-3rh7-494q-3mjq",
"modified": "2024-04-04T02:31:17Z",
"published": "2022-05-24T16:59:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3817"
},
{
"type": "WEB",
"url": "https://github.com/rpm-software-management/libcomps/issues/41"
},
{
"type": "WEB",
"url": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3898"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RJP-HFJX-9689
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2022-10-31 19:00In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c.
{
"affected": [],
"aliases": [
"CVE-2019-19950"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-24T01:15:00Z",
"severity": "HIGH"
},
"details": "In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c.",
"id": "GHSA-3rjp-hfjx-9689",
"modified": "2022-10-31T19:00:32Z",
"published": "2022-05-24T17:05:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19950"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00029.html"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/graphicsmagick/bugs/603"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4640"
},
{
"type": "WEB",
"url": "http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/44ab7f6c20b4"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00026.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00064.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RJW-X5RF-9PP3
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
{
"affected": [],
"aliases": [
"CVE-2026-32197"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T18:17:26Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.",
"id": "GHSA-3rjw-x5rf-9pp3",
"modified": "2026-04-14T18:30:41Z",
"published": "2026-04-14T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32197"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RMR-GXF2-F3FC
Vulnerability from github – Published: 2023-04-12 21:30 – Updated: 2023-04-12 21:30Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2023-26420"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-12T21:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-3rmr-gxf2-f3fc",
"modified": "2023-04-12T21:30:18Z",
"published": "2023-04-12T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26420"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb23-24.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3RP8-5Q68-6M8W
Vulnerability from github – Published: 2024-11-22 21:32 – Updated: 2024-11-22 21:32Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.
{
"affected": [],
"aliases": [
"CVE-2024-9722"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T21:15:25Z",
"severity": "HIGH"
},
"details": "Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.",
"id": "GHSA-3rp8-5q68-6m8w",
"modified": "2024-11-22T21:32:20Z",
"published": "2024-11-22T21:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9722"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1481"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.