Memory free() by controlled address in Remove() function.
vulners.com/securityvulns/securityvulns:doc:15987