Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Iterating over a pending TLS data list with `listIter` / `listNext` while calling `tlsHandleEvent` can cause a use-after-free vulnerability if event processing removes or frees list nodes. Dequeue or remove nodes prior to invoking the event callback.
TA flags are validated using a bitmask without explicitly checking and rejecting TA_FLAG_CONCURRENT. In user Trusted Applications, allowing TA_FLAG_CONCURRENT permits concurrent execution without required kernel locks, which can cause use-after-free and secure kernel memory corruption.
When copying or initializing a knote, checking the source knote's KN_QUEUED status instead of verifying the newly copied knote's state can lead to double-enqueuing and kqueue list corruption if an event triggers concurrently.
Iterating over pending connections using listIter/listNext while invoking event handlers like tlsHandleEvent can lead to use-after-free if callbacks synchronously close connections and delete nodes from the list.
Storing callback blocks in a Hash keyed by name can lead to premature garbage collection and use-after-free if the underlying C library supports overloaded functions or multiple callbacks per name. Consider storing callbacks in an Array to ensure they are not overwritten.
PostgreSQL transaction callback handles commit events without handling XACT_EVENT_ABORT. Transaction-scoped memory is reset on abort, which can cause use-after-free or dangling pointer dereferences in subsequent transactions.
XMP property tags parsed from an XML tree are directly added to the image properties splay tree without validation. This allows injection of wildcard tags (ending in ':*'), which can cause heap use-after-free vulnerabilities when properties are queried dynamically. Sanitize tags prior to addition.
A pointer returned by strtok/strtok_r points directly into the source buffer. Freeing the source buffer while the token pointer is still in use causes a use-after-free vulnerability.
Double-escaping a string with rfc1738_escape or reusing its return value as its own input leads to a Use-After-Free. The rfc1738_escape function manages a static internal buffer that can be dynamically reallocated. Passing the returned pointer back into rfc1738_escape can cause the function to read from the buffer after it has been freed during reallocation.
A memory resource is destructed or freed, but its corresponding pointer is subsequently assigned to another variable or lifecycle state field without first being set to NULL. This maintains a dangling pointer reference, leading to a reliable Use-After-Free (UAF) vulnerability if that component state is used or accessed later.
The mpileup reference cache struct uses only 2 slots (char *ref[2] / int ref_id[2] / hts_pos_t ref_len[2]), but the pileup pipeline with `-a` can require 3 concurrent live references (current contig, previous contig still being flushed for -a, and a look-ahead loaded by bam_mplp64_auto). With only 2 slots, mplp_get_ref() evicts and free()s a reference buffer
An early return triggered by a mismatch in `crypto_ahash_statesize` bypasses subsequent resource cleanup routines, causing a session reference count leak. In cryptodev-linux, this resulted in CVE-2026-28529. Ensure that validations properly release resources before returning, or remove the redundant check to securely delegate validation to the processing fun
xf_cliprdr_free_formats is called on $C->lastSentFormats without the surrounding xf_lock_x11/xf_unlock_x11 pair. The cliprdr channel thread can free this array while the X11 event thread concurrently iterates it in xf_clipboard_changed / xf_clipboard_format_equal, producing a heap use-after-free (CVE-2026-25997, CWE-416). Serialize the free with xf_lock_x11(
RdpgfxClientContext registers UpdateWindowFromSurface but does not register UnmapWindowForSurface in the same initializer. UpdateWindowFromSurface caches an XImage whose data pointer aliases the RDPGFX surface buffer; without an UnmapWindowForSurface callback to invalidate that cached alias before the surface backing buffer is freed by gdi_DeleteSurface, a m
A pointer `$P` is logged after its memory has been freed. This Use-After-Free (UAF) can trigger crashes with strict memory-checking tools (e.g., ASAN) and indicates unsafe memory lifecycle management. Reorder the code to log before freeing, or do not access the pointer after deallocation.
Resources are freed via StreamPool_Return or audio_formats_free without prior termination of the plugin/context thread. This causes a use-after-free if the background thread accesses these resources. Ensure thread synchronization (e.g., WaitForSingleObject, or a helper termination function) occurs before freeing context fields.
A use-after-free condition can occur if the `formats` array is freed but an active alias referencing one of the formats (e.g. `audin->format`) is not explicitly cleared. Concurrent threads accessing this dangling pointer may lead to a crash or arbitrary code execution. Ensure the active format is set to NULL before calling `audio_formats_free`.
The object returned by `get_MsConfig` is owned by the device object. Explicitly freeing it with `msusb_msconfig_free` causes a use-after-free vulnerability when the device object later dereferences the dangling pointer. Do not free this structure directly.
Missing yielding state verification during synchronization payload handling can lead to Use-After-Free if the underlying engine is replaced or freed. Ensure that asynchronous synchronization defers execution while scripts are currently yielding.
Resizing a single capability buffer (FreeRDP_ReceivedCapabilityData / FreeRDP_ReceivedCapabilities / FreeRDP_ReceivedCapabilityDataSizes) via freerdp_settings_set_pointer_len_ while bumping the shared FreeRDP_ReceivedCapabilitiesSize tracker leaves the three logically parallel arrays out of sync. Later code iterates all of them up to ReceivedCapabilitiesSize
Use-after-free / double-free: DeleteHint() is called on a hint manager after AddHint() has already transferred ownership of the same hint pointer to that manager. The hint manager owns and will eventually delete the hint object (and consumers of the manager may retain references into it), so an explicit DeleteHint() on the just-added pointer frees memory tha
Pointers are freed but not immediately set to NULL. If a subsequent memory allocation fails and the function returns early, the non-NULL dangling pointer may be freed again during cleanup, leading to a double-free vulnerability.
An element retrieved or deleted from an st_table is immediately freed. If secondary references to this element exist (e.g., on a parser stack), this causes a use-after-free and potential double-free. Verify ownership before freeing, or append the node to a retirement list for delayed garbage collection.
Taking the address of an element within a dynamically resized array can lead to a use-after-free if the pointer is cached across subsequent array resizes (e.g., in nested probing scenarios). When `reallocarray` moves the array, previously held element pointers become dangling. Fix this by keeping an array of pointers and allocating structures individually.
