Weakness · CWE-416
Use After Free
The program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-109618PHP: RCE via OOM corruptionCritical 9.2
- CVE-2026-109619PHP: RCE via stale global stateCritical 9.2
- CVE-2026-96934Windows 10 Version 1607: Windows DHCP Server Remote Code Execution VulnerabilityCritical 9.8
- CVE-2026-6653libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handlingHigh 7.0
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 10 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 10 techniques
- AC-6Least PrivilegeAccess Control · mitigates 8 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 8 techniques
- AC-2Account ManagementAccess Control · mitigates 6 techniques
- AC-4Information Flow EnforcementAccess Control · mitigates 6 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 6 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 6 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 6 techniques
- SC-7Boundary ProtectionSystem and Communications Protection · mitigates 6 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.