CWE-416
Use After Free
Description
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (8,192)
page 277 of 410| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-54911 | Hig | 0.47 | 7.3 | 0.01 | Sep 9, 2025 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-50159 | Hig | 0.47 | 7.3 | 0.01 | Aug 12, 2025 | Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-49682 | Hig | 0.47 | 7.3 | 0.00 | Jul 8, 2025 | Use after free in Windows Media allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-48798 | Hig | 0.47 | 7.3 | 0.00 | May 27, 2025 | A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues. | ||
| CVE-2025-31498 | Hig | 0.47 | — | 0.01 | Apr 8, 2025 | c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP… | ||
| CVE-2023-43842 | Hig | 0.47 | 7.3 | 0.00 | May 28, 2024 | Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials via HTTP POST request. | ||
| CVE-2024-26233 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26231 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26227 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26224 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26223 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26222 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2024-26221 | Hig | 0.47 | 7.2 | 0.02 | Apr 9, 2024 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2022-2586 | Med | 0.47 | 5.3 | 0.10 | KEV | Jan 8, 2024 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. | |
| CVE-2023-38669 | Hig | 0.47 | 8.3 | 0.01 | Jul 26, 2023 | Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition. | ||
| CVE-2021-42386 | Hig | 0.47 | 7.2 | 0.03 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function | ||
| CVE-2021-42385 | Hig | 0.47 | 7.2 | 0.03 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function | ||
| CVE-2021-42384 | Hig | 0.47 | 7.2 | 0.03 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function | ||
| CVE-2021-42383 | Hig | 0.47 | 7.2 | 0.02 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function | ||
| CVE-2021-42382 | Hig | 0.47 | 7.2 | 0.03 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function |
- risk 0.47cvss 7.3epss 0.01
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- risk 0.47cvss 7.3epss 0.01
Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally.
- risk 0.47cvss 7.3epss 0.00
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
- risk 0.47cvss 7.3epss 0.00
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.
- risk 0.47cvss —epss 0.01
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP…
- risk 0.47cvss 7.3epss 0.00
Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials via HTTP POST request.
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.47cvss 5.3epss 0.10
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
- risk 0.47cvss 8.3epss 0.01
Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.
- risk 0.47cvss 7.2epss 0.03
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function
- risk 0.47cvss 7.2epss 0.03
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
- risk 0.47cvss 7.2epss 0.03
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function
- risk 0.47cvss 7.2epss 0.02
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
- risk 0.47cvss 7.2epss 0.03
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function