Use-after-free bugs, a type of memory corruption, are challenging to detect statically. This post explores using Binary Ninja's MLIL to create a data flow graph that traces memory allocation interactions. The graph represents memory regions as nodes and pointer stores as edges, using tracked allocation, stack frame, dynamic memory, and global memory nodes. SSA variables are mapped to nodes, and offsets are stored to represent pointer arithmetic. Memory store and load operations create graph edges, assuming prior initialization for loads outside the function scope. Information propagates through the graph based on SSA variable assignments and offset calculations during pointer arithmetic. Callees are analyzed if arguments have mappings or stack offsets meet certain conditions, managing recursion to prevent infinite loops. After graph generation, instructions dependent on the tracked allocation node are logged. This analysis helps identify potential UAF vulnerabilities through context-insensitive reachability. The approach acknowledges inherent classification errors in static analysis but highlights adaptable primitives for other vulnerabilities.