Use after free vulnerabilities
The program keeps using memory after releasing it. Attackers shape what fills that memory to crash the program or take control of it.
Use after free in numbers
sbomify tracks 14,674 use after free vulnerabilities. Most are found in kernel (37%), browser (21%) and operating system (15%).
How to fix use after free vulnerabilities
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages.
Most exploited use after free vulnerabilities
- CVE-2025-24085 Apple Multiple Products Use-After-Free
- CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free
- CVE-2024-9680 Mozilla Firefox Use-After-Free
- CVE-2021-31166 Microsoft HTTP Protocol Stack Remote Code Execution
- CVE-2020-3992 VMware ESXi OpenSLP Use-After-Free
- CVE-2019-0708 Microsoft Remote Desktop Services Remote Code Execution
- CVE-2014-1776 Microsoft Internet Explorer Memory Corruption
- CVE-2024-4671 Google Chromium Visuals Use-After-Free
- CVE-2022-26486 Mozilla Firefox Use-After-Free
- CVE-2021-30633 Google Chromium Indexed DB API Use-After-Free
- CVE-2021-37973 Google Chromium Portals Use-After-Free
- CVE-2021-28550 Adobe Acrobat and Reader Use-After-Free
Recently published
- CVE-2025-55654 Use after free in n/a
- CVE-2025-60482 Use after free in n/a
- CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
- CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.
- CVE-2026-112036 Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
- CVE-2026-112094 michaelrsweet mxml mxml-file.c mxml_load_data use after free
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.