CWE-416 · Use After Free (page 19)
Page 19 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62555 | High | 7.0 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62553 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62472 | High | 7.8 | 2025-12-09 | Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-62221 | High | 7.8 | 2025-12-09 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-66627 | High | 8.4 | 2025-12-09 | Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1… |
CVE-2025-14326 | Critical | 9.8 | 2025-12-09 | Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146. |
CVE-2025-14321 | Critical | 9.8 | 2025-12-09 | Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. |
CVE-2025-62408 | Medium | 5.9 | 2025-12-08 | c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answe… |
CVE-2025-66326 | Medium | 6.7 | 2025-12-08 | Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-65955 | Medium | 4.9 | 2025-12-02 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in Imag… |
CVE-2025-13638 | High | 8.8 | 2025-12-02 | Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-13633 | High | 8.8 | 2025-12-02 | Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2025-20775 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20773 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20772 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20770 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-65407 | Medium | 6.5 | 2025-12-01 | A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS… |
CVE-2025-65405 | Medium | 6.5 | 2025-12-01 | A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service… |
CVE-2025-58408 | Medium | 5.9 | 2025-12-01 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and… |
CVE-2025-8045 | Medium | 4.0 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-6349 | Medium | 5.1 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-58311 | Medium | 5.8 | 2025-11-28 | UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2025-58307 | Medium | 6.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58303 | High | 8.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-65953 | | 2025-11-25 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP tran… | |
CVE-2025-65503 | Medium | 5.5 | 2025-11-24 | Use after free in endpoint destructors in Redboltz async_mqtt 10.2.5 allows local users to cause a denial of service via triggering SSL initialization failure… |
CVE-2025-61662 | High | 7.8 | 2025-11-18 | A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registe… |
CVE-2025-48593 | High | 8.0 | 2025-11-18 | In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution… |
CVE-2024-9126 | High | 7.5 | 2025-11-14 | Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2025-13120 | Medium | 5.3 | 2025-11-13 | A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use a… |
CVE-2011-10034 | | 2025-11-12 | AUTOMGEN versions up to and including 8.0.0.7 (also referenced as 8.022) contain a vulnerability in that project file handling frees an object and subsequently… | |
CVE-2025-11797 | High | 7.8 | 2025-11-12 | A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerabili… |
CVE-2025-40149 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock()… |
CVE-2025-64531 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61834 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61842 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vu… |
CVE-2025-62216 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62213 | High | 7.0 | 2025-11-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-62205 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62203 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62199 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-60723 | Medium | 6.3 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service ov… |
CVE-2025-60717 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-60716 | High | 7.0 | 2025-11-11 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-60707 | High | 7.8 | 2025-11-11 | Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59515 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-61818 | High | 7.8 | 2025-11-11 | InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2025-61817 | High | 7.8 | 2025-11-11 | InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2025-61815 | High | 7.8 | 2025-11-11 | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-61814 | High | 7.8 | 2025-11-11 | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-13020 | High | 8.8 | 2025-11-11 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13014 | High | 8.8 | 2025-11-11 | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbi… |
CVE-2025-64183 | High | 7.5 | 2025-11-10 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3… |
CVE-2025-12438 | High | 8.8 | 2025-11-10 | Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a… |
CVE-2025-12437 | High | 7.5 | 2025-11-10 | Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentia… |
CVE-2025-11756 | High | 8.8 | 2025-11-06 | Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2025-11460 | High | 8.8 | 2025-11-06 | Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium secur… |
CVE-2025-11219 | Low | 3.1 | 2025-11-06 | Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2023-43000 | High | 8.8 | 2025-11-05 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15… |
CVE-2025-54335 | Medium | 6.5 | 2025-11-04 | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclipse GPU Driver. |
CVE-2025-52910 | Critical | 9.8 | 2025-11-04 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to priv… |
CVE-2025-20745 | Medium | 4.2 | 2025-11-04 | In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20744 | Medium | 4.2 | 2025-11-04 | In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20743 | Medium | 4.2 | 2025-11-04 | In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-43478 | Medium | 5.5 | 2025-11-04 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An ap… |
CVE-2025-43457 | Medium | 6.5 | 2025-11-04 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS… |
CVE-2025-43438 | Medium | 4.3 | 2025-11-04 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26… |
CVE-2025-43434 | Medium | 4.3 | 2025-11-04 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26… |
CVE-2025-43432 | Medium | 4.3 | 2025-11-04 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1… |
CVE-2025-29699 | Medium | 6.5 | 2025-11-03 | NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. |
CVE-2025-57108 | Critical | 9.8 | 2025-10-31 | Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mes… |
CVE-2025-57109 | Medium | 6.5 | 2025-10-30 | Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene… |
CVE-2025-62230 | High | 7.3 | 2025-10-30 | A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures with… |
CVE-2025-62229 | High | 7.3 | 2025-10-30 | A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation c… |
CVE-2025-11465 | High | 7.8 | 2025-10-29 | Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-62788 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, w_copy_event_for_log() references memory (initia… |
CVE-2025-53814 | High | 7.8 | 2025-10-28 | A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .xml file can lead to heap-bas… |
CVE-2025-12380 | Critical | 9.8 | 2025-10-28 | Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC c… |
CVE-2025-12205 | Medium | 5.3 | 2025-10-27 | A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration… |
CVE-2025-12105 | High | 7.5 | 2025-10-23 | A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communi… |
CVE-2025-11979 | Medium | 5.3 | 2025-10-20 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under… |
CVE-2025-11677 | | 2025-10-20 | Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the… | |
CVE-2025-62504 | Medium | 6.5 | 2025-10-16 | Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the… |
CVE-2025-62491 | High | 8.8 | 2025-10-16 | A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->re… |
CVE-2025-62490 | High | 8.8 | 2025-10-16 | In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is n… |
CVE-2025-48008 | High | 7.5 | 2025-10-15 | When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's contro… |
CVE-2025-54279 | High | 7.8 | 2025-10-15 | Animate versions 23.0.13, 24.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2025-61802 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61801 | High | 7.8 | 2025-10-14 | Dimension versions 4.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current… |
CVE-2025-54281 | High | 7.8 | 2025-10-14 | Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-59290 | High | 7.8 | 2025-10-14 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59282 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute cod… |
CVE-2025-59243 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59238 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-59236 | High | 8.4 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59234 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-59227 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-59226 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-59225 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59224 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |