A use-after-free is a memory-safety bug in which a program continues to use a piece of memory after it has been released. Once memory is freed, the system may reuse it for something else, so the program ends up reading or writing data that no longer belongs to it. It occurs mainly in languages such as C and C++ that leave memory management to the programmer.
The consequences range from a crash to serious security impact. If an attacker can influence what is placed in the reused memory, they may be able to corrupt data or change how the program behaves, and in some cases run their own code. Use-after-free bugs are a common class of vulnerability in browsers, operating systems and other native software.
Not every use-after-free is exploitable. Whether it can be abused depends on the program, the memory layout, the attacker's control over the input and the protections in place. A vulnerability report using this term therefore describes the type of bug, not how easy it is to exploit or whether it has been exploited.
Developers reduce the risk with careful ownership rules, memory-safe languages, testing tools such as sanitizers and prompt dependency updates. Defenders should check the vendor advisory for affected versions, apply the fixed release and verify the version that is actually running.