← Back
CWE-416

8,553 CVEs • Abstraction: Variant • Likelihood of Exploit: High

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

JSON object

Loading...

CVEs (8,553)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Linux
1Linux Kernel
May 6, 2026
Dec 28, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspeci...Show more
Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.Show less
1Linux
1Linux Kernel
May 6, 2026
Dec 28, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cau...Show more
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.Show less
1Qemu
1Qemu
May 6, 2026
Dec 23, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to cra...Show more
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.Show less
1Google
1Chrome
May 6, 2026
Dec 18, 2016
N/A· v4
6.3 MEDIUM· v3
6.8 MEDIUM· v2
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via...Show more
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.Show less
1Google
1Chrome
May 6, 2026
Dec 18, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform...Show more
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.Show less
1Google
1Chrome
May 6, 2026
Dec 18, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potenti...Show more
PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.Show less
1Google
1Chrome
May 6, 2026
Dec 18, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
1Adobe
2Flash Player
Flash Player Desktop Runtime
Apr 21, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could le...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could lead to arbitrary code execution.Show less
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property of an array object. Successful exploitation could lead to arb...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property of an array object. Successful exploitation could lead to arbitrary code execution.Show less
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation co...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.Show less
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the PSDK's MediaPlayer class. Successful exploitation could lead to arbitrary code executio...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the PSDK's MediaPlayer class. Successful exploitation could lead to arbitrary code execution.Show less
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the Action Message Format serialization (AFM0). Successful exploitation could lead to arbit...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the Action Message Format serialization (AFM0). Successful exploitation could lead to arbitrary code execution.Show less
1Adobe
2Flash Player
Flash Player Desktop Runtime
May 6, 2026
Dec 15, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to objects at multiple presentation levels. Successful exploita...Show more
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to objects at multiple presentation levels. Successful exploitation could lead to arbitrary code execution.Show less
2Debian
Qemu
2Debian Linux
Qemu
May 6, 2026
Dec 10, 2016
N/A· v4
4.4 MEDIUM· v3
2.1 LOW· v2
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging fa...Show more
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.Show less
1Linux
1Linux Kernel
May 6, 2026
Dec 8, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on...Show more
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.Show less
2Canonical
Linux
2Linux Kernel
Ubuntu Linux
May 6, 2026
Dec 8, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket...Show more
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.Show less
1Bluez
1Bluez
May 6, 2026
Dec 3, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
1Dbd Mysql Project
1Dbd Mysql
May 6, 2026
Nov 29, 2016
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
2Debian
Wireshark
2Debian Linux
Wireshark
May 6, 2026
Nov 17, 2016
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/di...Show more
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.Show less