CWE-416 · Use After Free (page 22)
Page 22 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54913 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized att… |
CVE-2025-54912 | High | 7.8 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54911 | High | 7.3 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54908 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-54906 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54904 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54903 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54902 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54896 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54112 | High | 7.0 | 2025-09-09 | Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-54111 | High | 7.8 | 2025-09-09 | Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. |
CVE-2025-54108 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2025-54105 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-54103 | High | 7.4 | 2025-09-09 | Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-54102 | High | 7.8 | 2025-09-09 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54101 | Medium | 4.8 | 2025-09-09 | Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network. |
CVE-2025-54092 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-53807 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-53802 | High | 7.0 | 2025-09-09 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-36854 | High | 8.1 | 2025-09-08 | A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the r… |
CVE-2025-3212 | Medium | 5.3 | 2025-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-39721 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading… |
CVE-2025-39717 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in c… |
CVE-2025-39711 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE… |
CVE-2025-39698 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is… |
CVE-2025-39691 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: K… |
CVE-2025-39689 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of s… |
CVE-2025-38734 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [… |
CVE-2025-48543 | High | 8.8 | 2025-09-04 | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escal… |
CVE-2025-48539 | High | 8.0 | 2025-09-04 | In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead to remote (proximal/adjacent) code execu… |
CVE-2025-32332 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-38724 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently r… |
CVE-2025-38722 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into des… |
CVE-2025-38708 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD t… |
CVE-2025-38703 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data… |
CVE-2025-54588 | High | 7.5 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 cont… |
CVE-2025-22438 | High | 7.8 | 2025-09-02 | In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additi… |
CVE-2025-57616 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a… |
CVE-2025-20707 | Medium | 6.7 | 2025-09-01 | In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20706 | High | 7.8 | 2025-09-01 | In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20705 | High | 7.8 | 2025-09-01 | In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2024-58240 | Critical | 9.8 | 2025-08-28 | In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, t… |
CVE-2025-22412 | High | 8.8 | 2025-08-26 | In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code… |
CVE-2025-22411 | High | 8.8 | 2025-08-26 | In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjac… |
CVE-2025-22410 | High | 8.4 | 2025-08-26 | In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2025-22409 | High | 8.4 | 2025-08-26 | In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of priv… |
CVE-2025-22408 | Critical | 9.8 | 2025-08-26 | In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with… |
CVE-2025-22407 | Medium | 5.5 | 2025-08-26 | In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disc… |
CVE-2025-22406 | High | 8.4 | 2025-08-26 | In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of… |
CVE-2025-22405 | High | 8.4 | 2025-08-26 | In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2025-22404 | High | 8.4 | 2025-08-26 | In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privi… |
CVE-2025-22403 | Critical | 9.8 | 2025-08-26 | In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code ex… |
CVE-2025-0084 | High | 8.8 | 2025-08-26 | In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support… |
CVE-2025-0075 | Critical | 9.8 | 2025-08-26 | In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code… |
CVE-2025-0074 | Critical | 9.8 | 2025-08-26 | In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code exec… |
CVE-2023-21125 | High | 8.0 | 2025-08-26 | In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege… |
CVE-2025-9478 | High | 8.8 | 2025-08-26 | Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-9394 | Medium | 5.3 | 2025-08-24 | A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the… |
CVE-2025-9386 | Medium | 5.3 | 2025-08-24 | A vulnerability has been found in appneta tcpreplay up to 4.5.1. The impacted element is the function get_l2len_protocol of the file get.c of the component tcp… |
CVE-2025-9385 | Medium | 5.3 | 2025-08-24 | A flaw has been found in appneta tcpreplay up to 4.5.1. The affected element is the function fix_ipv6_checksums of the file edit_packet.c of the component tcpr… |
CVE-2025-38666 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp… |
CVE-2025-38656 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_s… |
CVE-2025-38653 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check p… |
CVE-2025-38627 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic The decompress_io_ctx may be… |
CVE-2025-38620 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: zloop: fix KASAN use-after-free of tag set When a zoned loop device, or zloop device, is… |
CVE-2025-38618 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to… |
CVE-2025-9157 | Medium | 5.3 | 2025-08-19 | A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet… |
CVE-2025-38598 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [ +0.000020] BUG: KAS… |
CVE-2025-38596 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is poten… |
CVE-2025-38595 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the… |
CVE-2025-38594 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Pu… |
CVE-2025-38584 | High | 7.0 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that… |
CVE-2025-38580 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_completion(… |
CVE-2025-38578 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [… |
CVE-2025-38577 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 00000… |
CVE-2025-38570 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP… |
CVE-2025-38555 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite… |
CVE-2025-38554 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays i… |
CVE-2025-38536 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix potential use-after-free in airoha_npu_get() np->name was being used aft… |
CVE-2025-38527 | Critical | 9.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_o… |
CVE-2025-9020 | Medium | 4.5 | 2025-08-15 | A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/mod… |
CVE-2025-50518 | Critical | 9.8 | 2025-08-14 | A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling… |
CVE-2025-8882 | High | 8.8 | 2025-08-13 | Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2025-54232 | High | 7.8 | 2025-08-12 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-54231 | High | 7.8 | 2025-08-12 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-54230 | High | 7.8 | 2025-08-12 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-54229 | High | 7.8 | 2025-08-12 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-54226 | High | 7.8 | 2025-08-12 | InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-54225 | High | 7.8 | 2025-08-12 | InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-54224 | High | 7.8 | 2025-08-12 | InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-54223 | High | 7.8 | 2025-08-12 | InCopy versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2025-49562 | Medium | 5.5 | 2025-08-12 | Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of… |
CVE-2025-49561 | High | 7.8 | 2025-08-12 | Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2025-53784 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53761 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-53740 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53738 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53735 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53734 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-53731 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |