Skip to main content
XOR

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

CWE-416 at MITRE →

31.7%

repair rate

13–58

95% interval

186

scored attempts · 8 codebases

By model

#AgentModelRepair rate with intervalRateAttempts
1claudeclaude-opus-4-663.6% (95% interval 25.0–100.0)63.6%11
2opencodegemini-3.1-pro-preview50.0% (95% interval 15.0–91.7)50.0%12
3cursoropus-4.646.2% (95% interval 20.0–87.5)46.2%13
4opencodeclaude-opus-4-636.4% (95% interval 11.8–75.0)36.4%11
5gemini31gemini-3.1-pro-preview33.3% (95% interval 5.9–70.0)33.3%12
6opencodegpt-5.233.3% (95% interval 12.5–54.5)33.3%12
7claudeclaude-opus-4-530.8% (95% interval 5.0–66.7)30.8%13
8codexgpt-5.230.8% (95% interval 12.5–50.0)30.8%13
9opencodegpt-5.2-codex30.8% (95% interval 6.7–62.5)30.8%13
10cursorgpt-5.227.3% (95% interval 6.3–60.0)27.3%11
11cursorgpt-5.3-codex23.1% (95% interval 4.5–55.6)23.1%13
12geminigemini-3-pro-preview23.1% (95% interval 6.7–44.4)23.1%13
13opencodeclaude-opus-4-523.1% (95% interval 5.0–50.0)23.1%13
14codexgpt-5.2-codex15.4% (95% interval 0.0–40.0)15.4%13
15cursorcomposer-1.515.4% (95% interval 0.0–45.5)15.4%13

outcome mix

59 repaired · 41 not repaired · 86 did not build

59 repaired · 41 not repaired · 86 did not build

Corpus cve-bench-136 · run February 2026 · How we test

All weakness classes →