CWE-763— Release of Invalid Pointer or Reference

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.— MITRE CWE catalog

139 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-763page 2 of 3

CVE-2021-47087HIGHCVSS 7.8EG 7.8
2024-03-04
In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix incorrect page free bug Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perfo…
CVE-2023-34312HIGHCVSS 7.8EG 7.8
2023-06-01
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition.
CVE-2022-48425HIGHCVSS 7.8EG 7.8
2023-03-19
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
CVE-2022-4696HIGHCVSS 7.8EG 7.8
2023-01-11
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, …
CVE-2022-24958HIGHCVSS 7.8EG 7.8
2022-02-11
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
CVE-2021-3939HIGHCVSS 7.8EG 7.8
2021-11-17
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This …
CVE-2020-12963HIGHCVSS 7.8EG 7.8
2021-11-15
An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the system.
CVE-2021-41073HIGHCVSS 7.8EG 7.8
2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVE-2021-28216HIGHCVSS 7.8EG 7.8
2021-08-05
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
CVE-2020-36404HIGHCVSS 7.8EG 7.8
2021-07-01
Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.
CVE-2020-12982HIGHCVSS 7.8EG 7.8
2021-06-11
An invalid object pointer free vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
CVE-2021-22760HIGHCVSS 7.8EG 7.8
2021-06-11
A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data, when …
CVE-2020-0444HIGHCVSS 7.8EG 7.8
2020-12-14
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…
CVE-2019-18619HIGHCVSS 7.8EG 7.8
2020-07-22
Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of e…
CVE-2019-19820HIGHCVSS 7.8EG 7.8
2020-01-10
An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402405 using M…
CVE-2013-4695HIGHCVSS 7.8EG 7.8
2019-12-27
Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
CVE-2019-9290HIGHCVSS 7.8EG 7.8
2019-09-27
In tzdata there is possible memory corruption due to a mismatch between allocation and deallocation functions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed …
CVE-2018-9557HIGHCVSS 7.8EG 7.8
2018-12-06
In really_install_package of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need…
CVE-2017-18075HIGHCVSS 7.8EG 7.8
2018-01-24
crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of serv…
CVE-2017-0731HIGHCVSS 7.8EG 7.8
2017-08-09
A elevation of privilege vulnerability in the Android media framework (mpeg4 encoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36075363.
CVE-2026-88340HIGHCVSS 7.6EG 7.6
2026-09-22
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_ru…
CVE-2026-96993HIGHCVSS 7.5EG 7.5
2026-11-10
Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
CVE-2026-112893HIGHCVSS 7.5EG 7.5
2026-10-19
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale gl…
CVE-2026-9516HIGHCVSS 7.5EG 7.5
2026-06-03
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past th…
CVE-2026-47312HIGHCVSS 7.5EG 7.5
2026-05-19
Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
CVE-2025-48431HIGHCVSS 7.5EG 7.5
2026-04-28
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Spec…
CVE-2025-11838HIGHCVSS 7.5EG 7.5
2025-12-04
A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a…
CVE-2023-4883HIGHCVSS 7.5EG 7.5
2023-10-03
Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and trig…
CVE-2023-25565HIGHCVSS 7.5EG 7.5
2023-02-14
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assume…
CVE-2022-41691HIGHCVSS 7.5EG 7.5
2022-10-19
When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.
CVE-2022-28203HIGHCVSS 7.5EG 7.5
2022-09-19
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
CVE-2022-37451HIGHCVSS 7.5EG 7.5
2022-08-06
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
CVE-2020-36224HIGHCVSS 7.5EG 7.5
2021-01-26
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
CVE-2020-5139HIGHCVSS 7.5EG 7.5
2020-10-12
A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.…
CVE-2020-9098HIGHCVSS 7.5EG 7.5
2020-04-30
Huawei OceanStor 5310 product with version of V500R007C60SPC100 has an invalid pointer access vulnerability. The software system access an invalid pointer when attacker malformed packet. Due to the insufficient validation of some parameter…
CVE-2022-25662HIGHCVSS 5.3EG 7.5
2022-10-19
Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVE-2024-25079HIGHCVSS 7.4EG 7.4
2024-05-15
A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating pr…
CVE-2026-105560HIGHCVSS 7.2EG 7.2
2026-11-10
Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network.
CVE-2024-42132HIGHCVSS 7.1EG 7.1
2024-07-30
In the Linux kernel, the following vulnerability has been resolved: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida all…
CVE-2021-21401HIGHCVSS 7.1EG 7.1
2021-03-23
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `one…
CVE-2020-5972HIGHCVSS 7.1EG 7.1
2020-06-30
NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be freed later, which may lead to tampering or denial of service. This affects vGPU version 8.x (prior to …
CVE-2026-105533HIGHCVSS 7.0EG 7.0
2026-11-10
Release of invalid pointer or reference in Windows COM allows an authorized attacker to elevate privileges locally.
CVE-2026-105513HIGHCVSS 7.0EG 7.0
2026-11-10
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerabilit…
CVE-2026-96097HIGHCVSS 7.0EG 7.0
2026-11-10
Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2026-105583HIGHCVSS 7.0EG 7.0
2026-11-10
Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-105582HIGHCVSS 7.0EG 7.0
2026-11-10
Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-83908HIGHCVSS 7.0EG 7.0
2026-10-13
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
CVE-2026-85362HIGHCVSS 7.0EG 7.0
2026-10-13
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2025-48768MEDIUMCVSS 6.5EG 6.5
2026-01-01
Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inode removal leading to a debug assert trigger (that is disabled by default), NUL…
CVE-2023-0459MEDIUMCVSS 6.5EG 6.5
2023-05-25
Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak informa…

Map vulnerabilities like CWE-763 to your infrastructure

EchelonGraph correlates every CVE — across CWE-763 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →