CWE-415— Double Free
The product calls free() twice on the same memory address.— MITRE CWE catalog
1,008 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-415page 15 of 21
- CVE-2017-5836HIGHCVSS 7.5EG 7.52017-03-03
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
- CVE-2005-0891HIGHCVSS 7.5EG 7.52005-05-02
Double free vulnerability in gtk 2 (gtk2) before 2.2.4 allows remote attackers to cause a denial of service (crash) via a crafted BMP image.
- CVE-2021-34981HIGHCVSS 6.7EG 7.52024-05-07
Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to exe…
- CVE-2024-3935HIGHCVSS 6.5EG 7.52024-10-30
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if th…
- CVE-2014-1252HIGHCVSS v2 7.5EG 7.52014-01-24
Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.
- CVE-2011-3892HIGHCVSS v2 7.5EG 7.52011-11-11
Double free vulnerability in the Theora decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.
- CVE-2011-2821HIGHCVSS v2 7.5EG 7.52011-08-29
Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression.
- CVE-2010-4494HIGHCVSS v2 7.5EG 7.52010-12-07
Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors relat…
- CVE-2004-0642HIGHCVSS v2 7.5EG 7.52004-09-28
Double free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary c…
- CVE-2003-0015HIGHCVSS v2 7.5EG 7.52003-02-07
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-pro…
- CVE-2025-49690HIGHCVSS 7.4EG 7.42025-07-08
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-21183HIGHCVSS 7.4EG 7.42025-02-11
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2025-21182HIGHCVSS 7.4EG 7.42025-02-11
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2024-44098HIGHCVSS 7.4EG 7.42024-10-25
In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n…
- CVE-2018-0102HIGHCVSS 7.4EG 7.42018-01-18
A vulnerability in the Pong tool of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the affe…
- CVE-2026-68994HIGHCVSS 7.3EG 7.32026-11-05
A double free vulnerability in NPU driver due to improper pointer management (941)
- CVE-2026-116260HIGHCVSS 7.3EG 7.32026-10-26
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be perform…
- CVE-2026-64621HIGHCVSS 7.3EG 7.32026-07-20
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorId…
- CVE-2026-58381HIGHCVSS 7.3EG 7.32026-07-02
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading…
- CVE-2021-1910HIGHCVSS 7.3EG 7.32021-05-07
Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear…
- CVE-2015-8962HIGHCVSS 7.3EG 7.32016-11-16
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device dur…
- CVE-2010-3957HIGHCVSS 7.3EG 7.32010-12-16
Double free vulnerability in the OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges…
- CVE-2026-6654HIGHCVSS 5.1EG 7.32026-04-20
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
- CVE-2024-27127HIGHCVSS 7.2EG 7.22024-05-21
A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network. We have already fixed the vulnerabi…
- CVE-2023-27320HIGHCVSS 7.2EG 7.22023-02-28
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
- CVE-2015-0058HIGHCVSS v2 7.2EG 7.22015-02-11
Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free…
- CVE-2014-1767HIGHCVSS v2 7.2EG 7.22014-07-08
Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wind…
- CVE-2010-3080HIGHCVSS v2 7.2EG 7.22010-09-21
Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an uns…
- CVE-2026-112457HIGHCVSS 7.1EG 7.12026-10-26
A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination…
- CVE-2026-110599HIGHCVSS 7.1EG 7.12026-10-14
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex…
- CVE-2026-61915HIGHCVSS 7.1EG 7.12026-09-09
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or …
- CVE-2026-69337HIGHCVSS 7.1EG 7.12026-09-08
Double free in Windows Registry allows an authorized attacker to elevate privileges over a network.
- CVE-2024-36030HIGHCVSS 7.1EG 7.12024-05-30
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning： drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column …
- CVE-2023-4389HIGHCVSS 7.1EG 7.12023-08-16
A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may…
- CVE-2021-1119HIGHCVSS 7.1EG 7.12021-10-29
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can double-free a pointer, which may lead to denial of service. This flaw may result in a write-what-where condition, allowing an attacker to …
- CVE-2021-28041HIGHCVSS 7.1EG 7.12021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
- CVE-2020-5988HIGHCVSS 7.1EG 7.12020-10-02
NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which allocated memory can be freed twice, which may lead to information disclosure or denial of service. This affects vGPU version 8.x (prior to 8.5), version 10.x…
- CVE-2019-0122HIGHCVSS 7.1EG 7.12019-03-14
Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.
- CVE-2026-119399HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-119992HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-103571HIGHCVSS 7.0EG 7.02026-11-10
An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevate…
- CVE-2026-105566HIGHCVSS 7.0EG 7.02026-11-10
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-105547HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
- CVE-2026-105545HIGHCVSS 7.0EG 7.02026-11-10
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code …
- CVE-2026-105526HIGHCVSS 7.0EG 7.02026-11-10
Double free in Winsock allows an authorized attacker to elevate privileges locally.
- CVE-2026-112796HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-96969HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- CVE-2026-95961HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-85862HIGHCVSS 7.0EG 7.02026-11-10
Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-125269HIGHCVSS 7.0EG 7.02026-11-09
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with…
Map vulnerabilities like CWE-415 to your infrastructure
EchelonGraph correlates every CVE — across CWE-415 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →