CWE-416
Use After Free
Description
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (8,192)
page 221 of 410| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-21756 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Windows Win32k Elevation of Privilege Vulnerability | ||
| CVE-2023-3269 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code,… | ||
| CVE-2023-31248 | Hig | 0.51 | 7.8 | 0.02 | Jul 5, 2023 | Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace | ||
| CVE-2023-3390 | Hig | 0.51 | 7.8 | 0.01 | Jun 28, 2023 | A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This… | ||
| CVE-2023-21147 | Hig | 0.51 | 7.8 | 0.00 | Jun 28, 2023 | In lwis_i2c_device_disable of lwis_device_i2c.c, there is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:… | ||
| CVE-2023-25002 | Hig | 0.51 | 7.8 | 0.00 | Jun 27, 2023 | A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | ||
| CVE-2023-25001 | Hig | 0.51 | 7.8 | 0.00 | Jun 27, 2023 | A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | ||
| CVE-2023-32398 | Hig | 0.51 | 7.8 | 0.00 | Jun 23, 2023 | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to execute arbitrary… | ||
| CVE-2023-28287 | Hig | 0.51 | 7.8 | 0.01 | Jun 17, 2023 | Microsoft Publisher Remote Code Execution Vulnerability | ||
| CVE-2023-29356 | Hig | 0.51 | 7.8 | 0.01 | Jun 16, 2023 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | ||
| CVE-2023-29321 | Hig | 0.51 | 7.8 | 0.00 | Jun 15, 2023 | Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a… | ||
| CVE-2023-21120 | Hig | 0.51 | 7.8 | 0.00 | Jun 15, 2023 | In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android… | ||
| CVE-2023-32018 | Hig | 0.51 | 7.8 | 0.01 | Jun 14, 2023 | Windows Hello Remote Code Execution Vulnerability | ||
| CVE-2023-29365 | Hig | 0.51 | 7.8 | 0.01 | Jun 14, 2023 | Windows Media Remote Code Execution Vulnerability | ||
| CVE-2023-29358 | Hig | 0.51 | 7.8 | 0.05 | Jun 14, 2023 | Windows GDI Elevation of Privilege Vulnerability | ||
| CVE-2023-28653 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2023 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-after-free vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the… | ||
| CVE-2023-3111 | Hig | 0.51 | 7.8 | 0.00 | Jun 5, 2023 | A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). | ||
| CVE-2023-2598 | Hig | 0.51 | 7.8 | 0.01 | Jun 1, 2023 | A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation. | ||
| CVE-2023-25006 | Hig | 0.51 | 7.8 | 0.00 | May 12, 2023 | A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution. | ||
| CVE-2022-29919 | Hig | 0.51 | 7.8 | 0.00 | May 10, 2023 | Use after free in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access. |
- risk 0.51cvss 7.8epss 0.00
Windows Win32k Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code,…
- risk 0.51cvss 7.8epss 0.02
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
- risk 0.51cvss 7.8epss 0.01
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This…
- risk 0.51cvss 7.8epss 0.00
In lwis_i2c_device_disable of lwis_device_i2c.c, there is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:…
- risk 0.51cvss 7.8epss 0.00
A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
- risk 0.51cvss 7.8epss 0.00
A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
- risk 0.51cvss 7.8epss 0.00
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to execute arbitrary…
- risk 0.51cvss 7.8epss 0.01
Microsoft Publisher Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.00
Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a…
- risk 0.51cvss 7.8epss 0.00
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android…
- risk 0.51cvss 7.8epss 0.01
Windows Hello Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Media Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.05
Windows GDI Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.00
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-after-free vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the…
- risk 0.51cvss 7.8epss 0.00
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().
- risk 0.51cvss 7.8epss 0.01
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.
- risk 0.51cvss 7.8epss 0.00
A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution.
- risk 0.51cvss 7.8epss 0.00
Use after free in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access.