CWE-416 · Use After Free (page 28)
Page 28 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-50413 | High | 8.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free We've already freed the assoc_data at this point, so n… |
CVE-2022-50411 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_… |
CVE-2022-50408 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_t… |
CVE-2023-53398 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop… |
CVE-2023-53388 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which… |
CVE-2023-53386 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("… |
CVE-2023-53377 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a pos… |
CVE-2023-53374 | High | 8.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early Not calling hci_(… |
CVE-2023-53373 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return val… |
CVE-2022-50386 | High | 8.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calli… |
CVE-2022-50384 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: Fix possible UAF in tsi148_dma_list_add Smatch report warning as follo… |
CVE-2022-50378 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/meson: reorder driver deinit sequence to fix use-after-free bug Unloading the driver… |
CVE-2025-7993 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2023-53363 | High | 7.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI: Assign… |
CVE-2023-53358 | High | 8.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue under cocurrent smb2 tree disconnect There is UAF issue under cocur… |
CVE-2023-53338 | Critical | 9.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positi… |
CVE-2022-50367 | High | 7.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return… |
CVE-2022-50363 | Critical | 9.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: skmsg: pass gfp argument to alloc_sk_msg() syzbot found that alloc_sk_msg() could be call… |
CVE-2025-9449 | High | 7.8 | 2025-09-17 | A Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to e… |
CVE-2023-53322 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. … |
CVE-2023-53316 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Free resources after unregistering them The DP component's unbind operation w… |
CVE-2023-53311 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount proce… |
CVE-2023-53307 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or… |
CVE-2023-53305 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2025-39826 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used… |
CVE-2025-39824 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinp… |
CVE-2025-10527 | High | 7.1 | 2025-09-16 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and… |
CVE-2023-53282 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write During the sy… |
CVE-2023-53263 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create We can… |
CVE-2025-43368 | Medium | 4.3 | 2025-09-15 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing malici… |
CVE-2023-53253 | High | 8.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hid_device devm allocation of input_dev name Use hid_device… |
CVE-2023-53252 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_l… |
CVE-2023-53235 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: drm/tests: helpers: Avoid a driver uaf when using __drm_kunit_helper_alloc_drm_device() t… |
CVE-2023-53219 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: media: netup_unidvb: fix use-after-free at del_timer() When Universal DVB card is detachi… |
CVE-2022-50329 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix p… |
CVE-2022-50328 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential use-after-free in jbd2_fc_wait_bufs In 'jbd2_fc_wait_bufs' use 'bh' a… |
CVE-2022-50310 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed If the initializa… |
CVE-2022-50305 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove()… |
CVE-2022-50300 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store… |
CVE-2022-50288 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure adapter->dcb would ge… |
CVE-2022-50283 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: mtd: core: add missing of_node_get() in dynamic partitions code This fixes unbalanced of_… |
CVE-2022-50274 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: adopts refcnt to avoid UAF dvb_unregister_device() is known that prone to… |
CVE-2023-53194 | High | 8.4 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in indx_get_root This adds a length check to guarantee the ret… |
CVE-2023-53187 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of new block group that became unused If a task creates a new b… |
CVE-2023-53153 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset… |
CVE-2022-50256 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: drm/meson: remove drm bridges at aggregate driver unbind time drm bridges added by meson_… |
CVE-2022-50252 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free con… |
CVE-2022-50245 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: rapidio: fix possible UAF when kfifo_alloc() fails If kfifo_alloc() fails in mport_cdev_o… |
CVE-2022-50243 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctp_auth_asoc_init_active_key When it returns an er… |
CVE-2022-50241 | High | 8.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occ… |
CVE-2022-50240 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outsid… |
CVE-2024-45434 | Critical | 9.8 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the la… |
CVE-2025-39785 | High | 7.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local The local variable is… |
CVE-2025-39776 | High | 7.0 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable… |
CVE-2025-39740 | High | 7.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if th… |
CVE-2025-10200 | High | 8.8 | 2025-09-10 | Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2025-54258 | High | 7.8 | 2025-09-09 | Substance3D - Modeler versions 1.22.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context o… |
CVE-2025-54257 | High | 7.8 | 2025-09-09 | Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-54242 | High | 7.8 | 2025-09-09 | Premiere Pro versions 25.3, 24.6.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of t… |
CVE-2025-55228 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55224 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55223 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privile… |
CVE-2025-54913 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized att… |
CVE-2025-54912 | High | 7.8 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54911 | High | 7.3 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54908 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-54906 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54904 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54903 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54902 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54896 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54112 | High | 7.0 | 2025-09-09 | Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-54111 | High | 7.8 | 2025-09-09 | Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. |
CVE-2025-54108 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2025-54105 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-54103 | High | 7.4 | 2025-09-09 | Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-54102 | High | 7.8 | 2025-09-09 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54101 | Medium | 4.8 | 2025-09-09 | Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network. |
CVE-2025-54092 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-53807 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-53802 | High | 7.0 | 2025-09-09 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-36854 | High | 8.1 | 2025-09-08 | A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the r… |
CVE-2025-3212 | Medium | 5.3 | 2025-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-39721 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading… |
CVE-2025-39717 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in c… |
CVE-2025-39711 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE… |
CVE-2025-39698 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is… |
CVE-2025-39691 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: K… |
CVE-2025-39689 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of s… |
CVE-2025-38734 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [… |
CVE-2025-48543 | High | 8.8 | 2025-09-04 | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escal… |
CVE-2025-48539 | High | 8.0 | 2025-09-04 | In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead to remote (proximal/adjacent) code execu… |
CVE-2025-32332 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-38724 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently r… |
CVE-2025-38722 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into des… |
CVE-2025-38708 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD t… |
CVE-2025-38703 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data… |
CVE-2025-54588 | High | 7.5 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 cont… |
CVE-2025-22438 | High | 7.8 | 2025-09-02 | In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additi… |