A double free is a memory corruption bug that happens when a program releases the same allocated block of memory more than once. In safe code, memory should be freed exactly once; doing it twice can confuse the allocator and corrupt internal data structures.
In cyber security, double frees matter because they can sometimes be turned into code execution, especially in long-running services written in C or C++. Attackers may trigger an error path, race condition, or malformed network input that causes the program to free the same object again. Defenders look for these bugs with fuzzing, code review, sanitizers, and hardened memory allocators, and they reduce risk by validating state transitions and making cleanup logic idempotent. In exposed services such as VPN or protocol negotiation components, a double free can become a pre-authentication attack path if the vulnerable code is reachable from the network.