Use-After-Free
Use-after-free is a memory-safety vulnerability where a program continues to use a pointer to memory that has already been freed, causing crashes, data corruption, or — when an attacker controls the reallocated memory — code execution.
Use-after-free (UAF) occurs in languages with manual memory management, such as C and C++, when memory is released back to the allocator but a pointer to it (a "dangling pointer") is still used to read or write. The freed region may be reused for a different object, so the stale access reads unexpected data, corrupts unrelated state, or lets an attacker who controls the new allocation influence program behavior.
Exploitation typically involves "heap grooming": the attacker times allocations so that attacker-controlled data lands in the freed slot, then triggers the dangling access to hijack a function pointer, virtual table, or object field. Combined with the loss of memory integrity, this frequently escalates to arbitrary code execution, which is why UAF bugs are among the most severe and commonly weaponized memory-safety flaws. It is cataloged as CWE-416, and related conditions include double-free (CWE-415).
Use-after-free is prevented by disciplined ownership and lifetime management: setting pointers to null after freeing, using smart pointers and RAII in C++, adopting memory-safe languages (such as Rust) where the compiler enforces lifetimes, and testing with sanitizers like AddressSanitizer and allocator hardening. For developers in native code, UAF matters because it is subtle, often non-deterministic, and disproportionately represented in critical CVEs.