CWE-590: Free of Memory not on the Heap
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
20 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-32911 — Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
- CVE-2025-42995 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42994 — Multiple vulnerabilities in SAP MDM Server
- CVE-2026-89161 — In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect
- CVE-2026-18582 — mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap
- CVE-2025-42996 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-5899 — GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap
- CVE-2026-47328 — Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling
- CVE-2025-7006 — Avast antivirus use of stack memory after free when scanning a malformed PE file
Recently published
- CVE-2026-89161 — In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect
- CVE-2026-18582 — mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap
- CVE-2025-7006 — Avast antivirus use of stack memory after free when scanning a malformed PE file
- CVE-2026-47328 — Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling
- CVE-2025-42996 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42995 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42994 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-5899 — GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap
- CVE-2025-32911 — Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value