CWE-415
Double Free
Description
The product calls free() twice on the same memory address.
Hierarchy (View 1000)
CVEs mapped to this weakness (835)
page 37 of 42| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-52384 | Med | 0.31 | 4.7 | 0.00 | May 14, 2024 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. | ||
| CVE-2023-52383 | Med | 0.31 | 4.7 | 0.00 | May 14, 2024 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. | ||
| CVE-2023-1032 | Med | 0.31 | 4.7 | 0.00 | Jan 8, 2024 | The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067. | ||
| CVE-2023-41911 | Med | 0.31 | 4.7 | 0.00 | Sep 28, 2023 | Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2). | ||
| CVE-2022-31117 | Med | 0.31 | 5.9 | 0.02 | Jul 5, 2022 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder,… | ||
| CVE-2026-5657 | Med | 0.29 | 5.5 | 0.00 | Apr 30, 2026 | iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service | ||
| CVE-2024-26846 | Med | 0.29 | 4.4 | 0.00 | Apr 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl… | ||
| CVE-2021-25477 | Med | 0.29 | 4.4 | 0.01 | Oct 6, 2021 | An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service. | ||
| CVE-2015-8894 | Med | 0.29 | 5.5 | 0.01 | Mar 15, 2017 | Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file. | ||
| CVE-2026-55653 | Med | 0.28 | 4.3 | 0.00 | Jun 23, 2026 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes… | ||
| CVE-2021-26954 | Med | 0.28 | 5.3 | 0.01 | Feb 9, 2021 | An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop. | ||
| CVE-2016-8619 | Med | 0.28 | 5.3 | 0.05 | Aug 1, 2018 | The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. | ||
| CVE-2016-8618 | Med | 0.28 | 5.3 | 0.05 | Jul 31, 2018 | The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. | ||
| CVE-2026-33995 | Med | 0.27 | 5.3 | 0.00 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP… | ||
| CVE-2024-26652 | Med | 0.27 | 4.1 | 0.00 | Mar 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev)… | ||
| CVE-2026-17573 | Med | 0.26 | — | 0.00 | Jul 27, 2026 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free. | ||
| CVE-2026-35188 | Med | 0.26 | 5.0 | 0.00 | Jun 9, 2026 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt… | ||
| CVE-2025-65955 | Med | 0.25 | 4.9 | 0.00 | Dec 2, 2025 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font… | ||
| CVE-2026-48850 | Low | 0.24 | 3.7 | 0.00 | May 25, 2026 | PuTTY 0.72 before 0.84 has a double free in RSA KEX. | ||
| CVE-2026-32848 | Med | 0.24 | 4.7 | 0.00 | May 18, 2026 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems.… |
- risk 0.31cvss 4.7epss 0.00
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.
- risk 0.31cvss 4.7epss 0.00
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.
- risk 0.31cvss 4.7epss 0.00
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
- risk 0.31cvss 4.7epss 0.00
Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).
- risk 0.31cvss 5.9epss 0.02
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder,…
- risk 0.29cvss 5.5epss 0.00
iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
- risk 0.29cvss 4.4epss 0.00
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl…
- risk 0.29cvss 4.4epss 0.01
An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.
- risk 0.29cvss 5.5epss 0.01
Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
- risk 0.28cvss 4.3epss 0.00
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes…
- risk 0.28cvss 5.3epss 0.01
An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop.
- risk 0.28cvss 5.3epss 0.05
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
- risk 0.28cvss 5.3epss 0.05
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.
- risk 0.27cvss 5.3epss 0.00
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP…
- risk 0.27cvss 4.1epss 0.00
In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev)…
- risk 0.26cvss —epss 0.00
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
- risk 0.26cvss 5.0epss 0.00
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt…
- risk 0.25cvss 4.9epss 0.00
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font…
- risk 0.24cvss 3.7epss 0.00
PuTTY 0.72 before 0.84 has a double free in RSA KEX.
- risk 0.24cvss 4.7epss 0.00
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems.…