CWE-590
Free of Memory not on the Heap
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
Impactr finds and proves whether CWE-590 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.