Cybersecurity glossary
What is Double Free?
Learn what a double-free vulnerability is, how freeing the same allocation twice corrupts the heap allocator, how attackers abuse double frees, and how ownership discipline prevents them.
Definition
A double free is a memory management flaw in which the same allocated memory block is passed to a deallocator more than once, corrupting allocator metadata and potentially enabling crashes, arbitrary writes, or code execution.
Why double frees matter
Allocators assume each live chunk is freed at most once. A second free of the same address violates that invariant and can scramble free lists, sizes, and coalescing logic.
Double Free bugs are easy to introduce in error-handling code and devastating when a custom or legacy allocator lacks strong checks. Even when the process simply aborts, attackers may still use the crash for denial of service against critical services.
How double-free corruption happens
Allocate a block
Code obtains a heap pointer and may copy it into multiple variables or structures.
First free succeeds
One cleanup path returns the chunk to the allocator.
Second free of same address
Another path, destructor, or error handler frees the stale pointer again.
Allocator metadata corrupts
Free-list pointers or chunk headers become inconsistent.
Later alloc/free misbehaves
Overlapping chunks or attacker-influenced writes can follow—or the process aborts.
Where double frees hide
Duplicate cleanup paths
goto fail, early return, and finalizers each free the same pointer.
Unclear caller/callee ownership
Both sides believe they own the buffer and both call free.
Copied raw pointers
Structs store duplicates; destroying the container frees twice.
Custom arenas
Homegrown allocators may lack double-free detection entirely.
Defensive practices
| Control | Notes |
|---|---|
| Single owner | Document and enforce who may free; prefer unique ownership types |
| RAII / smart pointers | Destructors free once when scope ends; avoid manual free pairs |
| Null on free | Clear the owning pointer; ensure no unchecked aliases remain |
| ASan testing | Detects double frees quickly in unit tests and fuzzing |
| Allocator hardening | Abort-on-double-free turns silent corruption into loud crashes in prod |
| Simplify error paths | Centralize cleanup to one function to avoid duplicated frees |
- Identify every free/delete site for each allocation family.
- Ensure exactly one owner is responsible for deallocation.
- Refactor duplicated cleanup into a single release helper.
- Replace owning raw pointers with unique_ptr/Box-style types where possible.
- Run ASan on tests that exercise error and teardown paths.
- Review custom allocators for double-free detection.
- Avoid freeing pointers received from APIs with unclear ownership contracts.
- Treat allocator abort logs mentioning double free as security defects.
The practical takeaway
A double free returns the same heap block to the allocator twice and can corrupt heap integrity. Enforce single ownership and one cleanup path.
If two functions both “helpfully” free the same pointer on errors, you likely have a double-free waiting to happen.
Related security terms
Use-After-Free
Closely related lifetime bug: using memory after it was freed.
Heap Overflow
Another way to corrupt heap allocator state and neighboring objects.
Uninitialized Memory
Lifetime mistakes can also leave stale or uninitialized pointers around.
Memory Corruption
Broader class that includes allocator-corrupting bugs like double free.
Frequently asked questions
What is a double free in simple terms?
The program asks the allocator to free the same memory address twice. The allocator’s internal lists become inconsistent, which can crash the process or be twisted into an exploit.
Is double free the same as use-after-free?
No, but they often share root causes. Double free frees twice; UAF uses memory after a free. Both signal broken ownership of a pointer.
Can modern malloc detect double frees?
Many allocators abort on obvious double frees. Detection is not universal across all platforms and custom allocators, and aborting still means denial of service.
How do attackers exploit double frees?
By shaping heap state so corrupted free-list metadata produces overlapping allocations or write primitives when chunks are later allocated and freed.
What coding mistakes cause double frees?
Multiple cleanup paths freeing the same pointer, unclear ownership between caller and callee, copied raw pointers, and error handling that frees then falls through to another free.
How do you prevent double frees?
Establish single ownership, free exactly once, null owning pointers after free when appropriate, prefer RAII/smart pointers, and test with ASan.
Does setting a pointer to NULL after free always fix it?
It helps when all copies are updated. If another variable still holds the old address, a second free can still occur.
References
Explore authoritative guidance and frameworks related to double free.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.