CWE-416Use After Free

Abstraction: Variant · CVEs in our corpus: 9,280

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Last updated: 16 October 2026 00:29 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 3 mapping(s) from 3 framework(s): STIG rhel 9 1 (mostly) · STIG oracle linux 8 1 (partial) · STIG rhel 8 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SI-16 Memory Protection
PR.PS-06
SA-11 Developer Testing and Evaluation
ID.RA-01

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

3 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

V1.4.3

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-16`	Memory Protection	SI	Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2021-22893` KEV	10.0	10.0	0.4717	2021-04-23
`CVE-2025-24085` KEV	10.0	10.0	0.1751	2025-01-27
`CVE-2014-1776` KEV	9.9	9.8	0.8268	2014-04-27
`CVE-2015-0313` KEV	9.9	9.8	0.9527	2015-02-02
`CVE-2015-5119` KEV	9.9	9.8	0.9934	2015-07-08
`CVE-2015-5122` KEV	9.9	9.8	0.9389	2015-07-14
`CVE-2015-5123` KEV	9.9	9.8	0.1883	2015-07-14
`CVE-2019-0708` KEV	9.9	9.8	1.0000	2019-05-16
`CVE-2020-3992` KEV	9.9	9.8	0.8302	2020-10-20
`CVE-2021-31166` KEV	9.9	9.8	0.9987	2021-05-11
`CVE-2024-9680` KEV	9.9	9.8	0.2318	2024-10-09
`CVE-2025-21298`	9.9	9.8	0.8091	2025-01-14
`CVE-2016-6309`	9.8	9.8	0.7022	2016-09-26
`CVE-2017-8895`	9.8	9.8	0.7100	2017-05-10
`CVE-2019-5096`	9.7	9.8	0.6698	2019-12-03
`CVE-2023-49606`	9.7	9.8	0.6308	2024-05-01
`CVE-2020-28018`	9.5	9.8	0.5647	2021-05-06
`CVE-2025-49844`	9.5	9.9	0.8229	2025-10-03
`CVE-2017-18017`	9.4	9.8	0.5284	2018-01-03
`CVE-2020-16017` KEV	9.4	9.6	0.0273	2021-01-08
`CVE-2021-30633` KEV	9.4	9.6	0.3318	2021-10-08
`CVE-2021-37973` KEV	9.4	9.6	0.1173	2021-10-08
`CVE-2022-26486` KEV	9.4	9.6	0.0235	2022-12-22
`CVE-2024-4671` KEV	9.4	9.6	0.0835	2024-05-14
`CVE-2017-16943`	9.3	9.8	0.4715	2017-11-25