CWE-763
Release of Invalid Pointer or Reference
Description
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Hierarchy (View 1000)
CVEs mapped to this weakness (98)
page 1 of 5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-14233 | Cri | 0.64 | 9.8 | 0.01 | Jan 16, 2026 | Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C… | ||
| CVE-2021-42377 | Cri | 0.64 | 9.8 | 0.03 | Nov 15, 2021 | An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered… | ||
| CVE-2021-30473 | Cri | 0.64 | 9.8 | 0.02 | May 6, 2021 | aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. | ||
| CVE-2020-0103 | Cri | 0.64 | 9.8 | 0.02 | May 14, 2020 | In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:… | ||
| CVE-2020-11105 | Cri | 0.64 | 9.8 | 0.02 | Mar 30, 2020 | An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is… | ||
| CVE-2018-6836 | Cri | 0.64 | 9.8 | 0.03 | Feb 8, 2018 | The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. | ||
| CVE-2026-52993 | Cri | 0.57 | 9.8 | 0.00 | Jun 24, 2026 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local… | ||
| CVE-2025-13824 | Hig | 0.57 | — | 0.00 | Dec 15, 2025 | A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become… | ||
| CVE-2025-25215 | Hig | 0.57 | 8.8 | 0.02 | Jun 13, 2025 | An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to … | ||
| CVE-2024-6607 | Hig | 0.57 | 8.8 | 0.01 | Jul 9, 2024 | It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This… | ||
| CVE-2022-42309 | Hig | 0.57 | 8.8 | 0.00 | Nov 1, 2022 | Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the… | ||
| CVE-2023-43532 | Hig | 0.55 | 8.4 | 0.00 | Feb 6, 2024 | Memory corruption while reading ACPI config through the user mode app. | ||
| CVE-2021-3682 | Hig | 0.55 | 8.5 | 0.03 | Aug 5, 2021 | A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free()… | ||
| CVE-2013-4695 | Hig | 0.54 | 7.8 | 0.05 | Dec 27, 2019 | Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution | ||
| CVE-2022-26942 | Hig | 0.53 | 8.2 | 0.00 | Oct 19, 2023 | The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with… | ||
| CVE-2022-31625 | Hig | 0.53 | 8.1 | 0.04 | Jun 16, 2022 | In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE… | ||
| CVE-2025-47329 | Hig | 0.51 | 7.8 | 0.00 | Sep 24, 2025 | Memory corruption while handling invalid inputs in application info setup. | ||
| CVE-2025-47749 | Hig | 0.51 | 7.8 | 0.00 | May 19, 2025 | V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. | ||
| CVE-2025-30379 | Hig | 0.51 | 7.8 | 0.01 | May 13, 2025 | Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||
| CVE-2024-36890 | Hig | 0.51 | 7.8 | 0.00 | May 30, 2024 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char… |
- risk 0.64cvss 9.8epss 0.01
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C…
- risk 0.64cvss 9.8epss 0.03
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered…
- risk 0.64cvss 9.8epss 0.02
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
- risk 0.64cvss 9.8epss 0.02
In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:…
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is…
- risk 0.64cvss 9.8epss 0.03
The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- risk 0.57cvss 9.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local…
- risk 0.57cvss —epss 0.00
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become…
- risk 0.57cvss 8.8epss 0.02
An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to …
- risk 0.57cvss 8.8epss 0.01
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This…
- risk 0.57cvss 8.8epss 0.00
Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the…
- risk 0.55cvss 8.4epss 0.00
Memory corruption while reading ACPI config through the user mode app.
- risk 0.55cvss 8.5epss 0.03
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free()…
- risk 0.54cvss 7.8epss 0.05
Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
- risk 0.53cvss 8.2epss 0.00
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with…
- risk 0.53cvss 8.1epss 0.04
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE…
- risk 0.51cvss 7.8epss 0.00
Memory corruption while handling invalid inputs in application info setup.
- risk 0.51cvss 7.8epss 0.00
V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
- risk 0.51cvss 7.8epss 0.01
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- risk 0.51cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char…