The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
6,899 vulnerabilities with CWE-416
CVE-2026-7322
HIGH
Memory safety bugs fixed in Firefox ESR 115.35.1, Firefox ESR 140.10.1, Thunderbird ESR 140.10.1, Firefox 150.0.1 and Thunderbird 150.0.1
CVSS 7.3
CVE-2026-5943
HIGH
Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability
CVSS 7.8
CVE-2026-5942
MEDIUM
Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability
CVSS 5.5
CVE-2026-5940
HIGH
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
CVSS 7.8
CVE-2026-5939
MEDIUM
UAF in Foxit PDF Editor/Reader via XFA calculate event
CVSS 5.5
CVE-2026-6786
HIGH
Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
CVSS 8.1
CVE-2026-6785
HIGH
Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
CVSS 8.1
CVE-2026-31669
CRITICAL
mptcp: fix slab-use-after-free in __inet_lookup_established
CVSS 9.8
CVE-2026-31665
HIGH
netfilter: nft_ct: fix use-after-free in timeout object destroy
CVSS 7.8
CVE-2026-31652
HIGH
mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
CVSS 7.8
CVE-2026-31650
HIGH
mmc: vub300: fix use-after-free on disconnect
CVSS 7.8
CVE-2026-31644
HIGH
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
CVSS 7.8
CVE-2026-31597
HIGH
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
CVSS 7.8
CVE-2026-31589
CRITICAL
mm: call ->free_folio() directly in folio_unmap_invalidate()
CVSS 9.8
CVE-2026-31588
HIGH
KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVSS 8.8
CVE-2026-31587
HIGH
ASoC: qcom: q6apm: move component registration to unmanaged version
CVSS 7.8
CVE-2026-31586
HIGH
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
CVSS 7.8
CVE-2026-31584
HIGH
media: mediatek: vcodec: fix use-after-free in encoder release path
CVSS 7.8
CVE-2026-31583
HIGH
media: em28xx: fix use-after-free in em28xx_v4l2_open()
CVSS 7.8
CVE-2026-31582
HIGH
hwmon: (powerz) Fix use-after-free on USB disconnect
CVSS 7.8
CVE-2026-31581
HIGH
ALSA: 6fire: fix use-after-free on disconnect
CVSS 7.8
CVE-2026-31580
HIGH
bcache: fix cached_dev.sb_bio use-after-free and crash
CVSS 7.8
CVE-2026-31578
HIGH
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
CVSS 7.8
CVE-2026-31576
HIGH
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
CVSS 7.8
CVE-2026-31566
HIGH
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
CVSS 7.8
Details
Vulnerabilities
6,899
Exploit Likelihood
High