CWE-416
7,549 CVEs • Abstraction: Variant • Likelihood of Exploit: High
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVEs (7,549)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious...Show more |
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kerne...Show more |
Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled. |
3Debian FedoraprojectLinux3Debian Linux FedoraLinux KernelJun 17, 2026 Jan 4, 2024 N/A· v4 7.0 HIGH· v3 N/A· v2 A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the...Show more |
Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security sever...Show more |
3Fedoraproject Packagekit ProjectRedhat3Enterprise Linux FedoraPackagekitJun 17, 2026 Jan 3, 2024 N/A· v4 3.3 LOW· v3 N/A· v2 A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously f...Show more |
Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component. |
2Linux Redhat35Codeready Linux Builder Codeready Linux Builder For Arm64Codeready Linux Builder For Arm64 Eus+32 moreJun 17, 2026 Jan 2, 2024 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-afte...Show more |
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer. |
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer. |
1Qualcomm 81Ar8035 Firmware Fastconnect 6200 FirmwareFastconnect 6700 Firmware+78 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. |
1Qualcomm 227315 5g Iot Modem Firmware 9206 Lte Modem FirmwareApq8017 Firmware+224 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption in Audio when memory map command is executed consecutively in ADSP. |
1Qualcomm 130Ar8035 Firmware Csra6620 FirmwareCsra6640 Firmware+127 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. |
1Qualcomm 136Ar8035 Firmware Csra6620 FirmwareCsra6640 Firmware+133 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command. |
1Qualcomm 111315 5g Iot Modem Firmware Aqt1000 FirmwareAr8031 Firmware+108 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time. |
1Qualcomm 26Qam8255p Firmware Qam8295p FirmwareQam8650p Firmware+23 moreJun 17, 2026 Jan 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued. |