# Use After Free

> Use-after-free exploitation: dangling refs, reclaim/spray, type confusion, C++ vptr hijack, kernel pool UAF notes.

- Skill: `netvar1337/use-after-free` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/use-after-free`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/use-after-free/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/use-after-free

---


# Use-after-free (UAF)

## Root patterns
- Explicit free/delete then use
- Callback after teardown
- Iterator into cleared container
- Refcount underflow → premature destroy (`integer-overflow` underflow)

## Exploit path
1. Stabilize free trigger
2. Identify dangling object type/size
3. Spray same-size controlled allocations
4. Corrupt virtual function table / function ptr / length+buffer
5. Call path that trusts dangling object

## C++ tips
- vptr first qword/qword on MSVC/Itanium layouts — confirm
- Fake vtable in controlled spray; ensure RX or pivot to stack ROP if DEP

## Kernel pool UAF (high level)
- Pool backend/lookaside differences
- Quota/process context
- Prefer data-only (token) when SMEP/SMAP/CIG

## Pair with
`heap-exploitation`, `kernel-dev`, `c-review`.