Thanks, I should have tried harder, any old email will do. After looking at the paper I think the issue is that they are counting CWEs assigned to CVEs, but CW

Thanks, I should have tried harder, any old email will do. After looking at the paper I think the issue is that they are counting CWEs assigned to CVEs, but CWE assignment to CVEs is not very granular / accurate. For a contrasting point of view here’s an alternative reference: “FreeSentry: Protecting Against Use-After-Free Vulnerabilities Due to Dangling Pointers” - https://pdfs.semanticscholar.org/3829/df26d4ce686251b9b5030893febd75162539.pdf https://pdfs.semanticscholar.org/3829/df26d4ce686251b9b50308... - “In 2011 and 2012, the most exploited memory errors for Microsoft products were use-after-free vulnerabilities. It was also the most exploited vulnerability for both Windows Vista and Windows 7 and is the most common type of memory error that occurs in Internet Explorer.”. Ok, that’s a bit old. Also why doesn’t it show up in the data? In an unscientific sanity check (bit slow to do because on mobile) I am not sure UAF is getting all the credit it deserves in CVE classification. For example https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2019-0570 https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20... is a UAF (https://www.exploit-db.com/exploits/46184 https://www.exploit-db.com/exploits/46184) but is listed as CWE category 264 (permissions, privileges and access controls). CVE-2017-8540 https://www.cvedetails.com/cve/cve-2017-8540 https://www.cvedetails.com/cve/cve-2017-8540 is also a UAF but is listed as CWE category 119 (memory corruption / code exec), ref: https://www.exploit-db.com/exploits/42088 https://www.exploit-db.com/exploits/42088 I think I could find a lot more. CWE assignment to CVEs is not really an exact science. I suspect UAFs are getting under-counted because the bugs just went into “privesc” or “memory corruption / buffer overflow” buckets.