Skip to content
Log inStart free trial

CWE-416: Use After Free

VariantLikelihood of exploit: High

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Consequences

  • Integrity: Modify Memory
  • Availability: DoS: Crash, Exit, or Restart
  • Confidentiality: Read Memory
  • Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands

How to prevent it

  • Architecture and Design: Choose a language that provides automatic memory management.
  • Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Recent advisories

  • CVE-2026-109619 — PHP has various global state that temporarily points into request memory.
  • CVE-2026-109618 — PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
  • GHSA-7mwm-ghpf-9vrm — Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
  • GHSA-4rr5-89j8-mwwm — Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
  • GHSA-wq5f-xc86-pv6w — sharp : Vulnerability in librsvg dependency CVE-2026-96889
  • RUSTSEC-2026-0326 — Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
  • CVE-2026-68820 — Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
  • GHSA-c494-m2fq-59mx — Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability
  • GHSA-9hj4-r449-hfvc — Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
  • GHSA-cq5v-8q36-5273 — AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
  • GHSA-6jwg-7q3p-5fqm — ImageMagick: Use-After-Free when freetype initialization fails
  • GHSA-qvxh-prvr-85w2 — ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
  • GHSA-qh5g-q395-cx4j — ImageMagick: Heap-use-after-free via XMP profile could result in a crash
  • GHSA-ff5c-8x9r-8qcw — ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
  • GHSA-m578-w5vf-rfcm — Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

All advisories for CWE-416

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor