CWE-416
Use After Free
Description
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (8,218)
page 171 of 411| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-49675 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-49665 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-49660 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-48806 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally. | ||
| CVE-2025-48000 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-47991 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-47976 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-27056 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Memory corruption during sub-system restart while processing clean-up to free up resources. | ||
| CVE-2025-27050 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Memory corruption while processing event close when client process terminates abruptly. | ||
| CVE-2025-27047 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Memory corruption while processing the TESTPATTERNCONFIG escape path. | ||
| CVE-2025-21466 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | Memory corruption while processing a private escape command in an event trigger. | ||
| CVE-2025-38236 | Hig | 0.51 | 7.8 | 0.00 | Jul 8, 2025 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2… | ||
| CVE-2025-38227 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Terminating the subsequent process of initialization failure syzbot reported a slab-use-after-free Read in vidtv_mux_init. [1] After PSI initialization fails, the si member is accessed again,… | ||
| CVE-2025-38212 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/[email protected]/ idr_for_each()… | ||
| CVE-2025-38187 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC… | ||
| CVE-2025-38180 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF. | ||
| CVE-2025-38176 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled kernel, I've noticed the following: BUG: KASAN: slab-use-after-free in… | ||
| CVE-2025-38175 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") addressed a use-after-free where devices could be released without first being removed from… | ||
| CVE-2025-38172 | Hig | 0.51 | 7.8 | 0.00 | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the primary is a… | ||
| CVE-2025-38154 | Hig | 0.51 | 7.8 | 0.00 | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release… |
- risk 0.51cvss 7.8epss 0.00
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally.
- risk 0.51cvss 7.8epss 0.00
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Memory corruption during sub-system restart while processing clean-up to free up resources.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing event close when client process terminates abruptly.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing the TESTPATTERNCONFIG escape path.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing a private escape command in an event trigger.
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Terminating the subsequent process of initialization failure syzbot reported a slab-use-after-free Read in vidtv_mux_init. [1] After PSI initialization fails, the si member is accessed again,…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/[email protected]/ idr_for_each()…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF.
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled kernel, I've noticed the following: BUG: KASAN: slab-use-after-free in…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") addressed a use-after-free where devices could be released without first being removed from…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the primary is a…
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release…