VYPR

CWE-416

Use After Free

VariantStableLikelihood: High

Description

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (8,284)

page 3 of 415
  • CVE-2022-3038HigKEVSep 26, 2022
    Google
    Chrome
    risk 0.71cvss 8.8epss 0.25

    Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  • CVE-2022-0609HigKEVApr 5, 2022
    Google
    Chrome
    risk 0.71cvss 8.8epss 0.22

    Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  • CVE-2022-22620HigKEVMar 18, 2022
    Apple Inc.
    macOS
    risk 0.71cvss 8.8epss 0.16

    A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution.…

  • CVE-2020-0674HigKEVFeb 11, 2020
    Microsoft
    Internet Explorer
    risk 0.71cvss 7.5epss 0.87

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712,…

  • CVE-2019-2215HigKEVOct 11, 2019
    Google
    Android
    risk 0.71cvss 7.8epss 0.72

    A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate…

  • CVE-2019-0211HigKEVApr 8, 2019
    Apache
    HTTP Server
    risk 0.71cvss 7.8epss 0.65

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent…

  • CVE-2016-9079HigKEVJun 11, 2018
    Mozilla Corporation
    Firefox
    risk 0.71cvss 7.5epss 0.87

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird <…

  • CVE-2016-7892HigKEVDec 15, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.71cvss 8.8epss 0.19

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

  • CVE-2016-7855HigKEVNov 1, 2016
    Adobe Inc.
    Flashplayer
    risk 0.71cvss 8.8epss 0.25

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.

  • CVE-2014-8439HigKEVNov 25, 2014
    Adobe Inc.
    Air
    risk 0.71cvss 8.8epss 0.20

    Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code…

  • CVE-2026-5281HigKEVApr 1, 2026
    Google
    Chrome
    risk 0.70cvss 8.8epss 0.05

    Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

  • CVE-2025-43529HigKEVDec 17, 2025
    Apple Inc.
    macOS
    risk 0.70cvss 8.8epss 0.09

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to…

  • CVE-2023-43000HigKEVNov 5, 2025
    Apple Inc.
    macOS
    risk 0.70cvss 8.8epss 0.04

    A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

  • CVE-2025-29824HigKEVApr 8, 2025
    Microsoft
    Windows Common Log File System Driver
    risk 0.70cvss 7.8epss 0.14

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  • CVE-2025-21298CriJan 14, 2025
    Microsoft
    Windows OLE
    risk 0.70cvss 9.8epss 0.81

    Windows OLE Remote Code Execution Vulnerability

  • CVE-2023-32373HigKEVJun 23, 2023
    Apple Inc.
    macOS
    risk 0.70cvss 8.8epss 0.12

    A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code…

  • CVE-2022-26485HigKEVDec 22, 2022
    Mozilla Corporation
    Firefox
    risk 0.70cvss 8.8epss 0.14

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and…

  • CVE-2022-38181HigKEVOct 25, 2022
    Arm
    Mali GPU Kernel Driver
    risk 0.70cvss 8.8epss 0.14

    The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.

  • CVE-2021-4102HigKEVFeb 11, 2022
    Google
    Chrome
    risk 0.70cvss 8.8epss 0.08

    Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  • CVE-2021-30661HigKEVSep 8, 2021
    Apple Inc.
    macOS
    risk 0.70cvss 8.8epss 0.04

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is…