Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

CVEs (8,593)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-26134 1Microsoft 2365 Copilot Office Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVE-2026-26132 1Microsoft 9Windows 10 21h2 Windows 10 22h2Windows 11 23h2+6 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-26107 1Microsoft 5365 Apps ExcelOffice+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-25189 1Microsoft 5Windows 10 1809 Windows 10 21h2Windows 10 22h2+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-25178 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-25171 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2026-25170 1Microsoft 7Windows 11 23h2 Windows 11 24h2Windows 11 25h2+4 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-25167 1Microsoft 4Windows 11 24h2 Windows 11 25h2Windows 11 26h1+1 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.4 HIGH· v3 N/A· v2 Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.
CVE-2026-24295 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-24292 1Microsoft 11Windows 10 1809 Windows 10 21h2Windows 10 22h2+8 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-24289 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 19, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-24285 1Microsoft 15365 Copilot OfficeWindows 10 1607+12 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-23671 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-23669 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Use after free in RPC Runtime allows an authorized attacker to execute code over a network.
CVE-2026-23667 1Microsoft 7Windows 10 1809 Windows 10 21h2Windows 10 22h2+4 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.
CVE-2026-28688 1Imagemagick 1Imagemagick Jun 17, 2026 Mar 10, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image...Show more ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.Show less
CVE-2026-28687 1Imagemagick 1Imagemagick Jun 17, 2026 Mar 10, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker...Show more ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.Show less
CVE-2026-28799 1Pjsip 1Pjsip Jun 17, 2026 Mar 6, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during...Show more PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.Show less
CVE-2025-13350 - - Jun 17, 2026 Mar 5, 2026 7.1 HIGH· v4 N/A· v3 N/A· v2 Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collecto...Show more Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.Show less
CVE-2026-22040 1Emqx 1Nanomq Jun 17, 2026 Mar 4, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massi...Show more NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory corruption in the Broker process, causing it to exit immediately with SIGABRT due to free(): invalid pointer. As of time of publication, no known patched versions are available.Show less

Previous 1...9899100...430 Next