CWE-416: Use After Free
Sources read 2026-10-30. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
MITRE classes it as a variant-level weakness and rates the likelihood of exploit as high.
What it lets an attacker do
From MITRE's CWE catalogue
- Modify Memory (affects: integrity)
- DoS: Crash, Exit, or Restart (affects: availability)
- Read Memory (affects: confidentiality)
- Execute Unauthorized Code or Commands (affects: integrity, confidentiality, availability)
On CISA's exploited list
From CISA's exploited list
3 of the 109 entries CISA added from 2026-08-04 to 2026-11-01 name CWE-416, against 1 of 70 in the 90 days before. Over the whole catalogue 95 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-109618, PHP Group PHP, added 2026-10-26
- CVE-2026-109619, PHP Group PHP, added 2026-10-26
- CVE-2026-68820, Microsoft Windows Ancillary Function Driver for WinSock , added 2026-08-11
- CVE-2010-0249, Microsoft Internet Explorer, added 2026-05-20
- CVE-2020-9715, Adobe Acrobat, added 2026-04-13
How MITRE says to find it
From MITRE's CWE catalogue
- Fuzzing
- Automated Static Analysis
- Automated Dynamic Analysis
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us