diff --git a/CHANGELOG.md b/CHANGELOG.md
index e604eeee9..ff3a50309 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Fixed `lf search`, `lf t55xx detect`, `data modulation` and the TI/Visa2000/ZX8211 demods leaking the saved graph and demod buffers on every call (@r3wretrhy)
 - Fixed corrected `sim014.bin` references to `sim024.bin` as `sim014.bin` does not exist in this repo currently, thus removing some newbie confusion. (@innocentbystanderproxmark)
 - Added `A1856618` (an EM4305 anti-clone card password) to the `t55xx_default_pwds` dictionary used by `lf em 4x05 chk` (@nemanjan00)
 - Added `hw bwm ble` - the BWM's BLE settings: `on`/`off` (persisted radio switch), `pairing` (require a 6-digit passkey, LE Secure Connections; the module ships open), `forget` bonded devices, `txpower`, `status` (@Msprg)
diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 612acd152..3581c57d6 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -2798,6 +2798,7 @@ static int try_detect_modulation(void) {
             }
             //undo trim samples
             restore_graphbuffer(saveState);
+            free_buffer_savestate(saveState);
         }
     }
 
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 97f573b10..aa6bb2ad6 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -1733,6 +1733,8 @@ out:
 
     restore_graphbuffer(saveState_gb);
 
+    free_buffer_savestate(saveState_db);
+    free_buffer_savestate(saveState_gb);
     return retval;
 }
 
diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 76675b2f5..6f3db9380 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -124,6 +124,7 @@ static buffer_savestate_t t55xx_psk_trim_head(void) {
 static void t55xx_psk_untrim_head(buffer_savestate_t st) {
     s_sample_bias = 0;
     restore_graphbuffer(st);
+    free_buffer_savestate(st);
 }
 
 // the bit offset to read a block at in the demod buffer loaded right now
diff --git a/client/src/cmdlfti.c b/client/src/cmdlfti.c
index 57965d8d2..99d0a237f 100644
--- a/client/src/cmdlfti.c
+++ b/client/src/cmdlfti.c
@@ -100,6 +100,7 @@ int demodTI(bool verbose) {
     int retval = PM3_ESOFT;
 
     if (g_GraphTraceLen < convLen) {
+        free_buffer_savestate(saveState);
         return retval;
     }
     for (i = 0; i < g_GraphTraceLen - convLen; i++) {
@@ -280,6 +281,7 @@ out:
         restore_graphbuffer(saveState);
     }
 
+    free_buffer_savestate(saveState);
     return retval;
 }
 
diff --git a/client/src/cmdlfvisa2000.c b/client/src/cmdlfvisa2000.c
index 93e8ff466..f4eca3123 100644
--- a/client/src/cmdlfvisa2000.c
+++ b/client/src/cmdlfvisa2000.c
@@ -93,6 +93,7 @@ int demodVisa2k(bool verbose) {
     if (ASKDemod_ext(64, 0, 0, 0, false, false, false, 1, &st) != PM3_SUCCESS) {
         PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ASK/Manchester Demod failed");
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     size_t size = g_DemodBufferLen;
@@ -108,6 +109,7 @@ int demodVisa2k(bool verbose) {
             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ans: %d", ans);
 
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     setDemodBuff(g_DemodBuffer, 96, ans);
@@ -126,6 +128,7 @@ int demodVisa2k(bool verbose) {
     if (chk != calc) {
         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 checksum (%s) %x - %x\n", _RED_("fail"), chk, calc);
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     // parity
@@ -134,9 +137,11 @@ int demodVisa2k(bool verbose) {
     if (calc_par != chk_par) {
         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 parity (%s) %x - %x\n", _RED_("fail"), chk_par, calc_par);
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     PrintAndLogEx(SUCCESS, "Visa2000 - Card " _GREEN_("%u") ", Raw: %08X%08X%08X", raw2,  raw1, raw2, raw3);
+    free_buffer_savestate(saveState);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdlfzx8211.c b/client/src/cmdlfzx8211.c
index 00e19d152..7e2352418 100644
--- a/client/src/cmdlfzx8211.c
+++ b/client/src/cmdlfzx8211.c
@@ -50,6 +50,7 @@ int demodzx(bool verbose) {
     if (ASKDemod_ext(64, 0, 0, 0, false, false, false, 1, &st) != PM3_SUCCESS) {
         PrintAndLogEx(DEBUG, "DEBUG: Error - ZX: ASK/Manchester Demod failed");
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     size_t size = g_DemodBufferLen;
@@ -65,6 +66,7 @@ int demodzx(bool verbose) {
             PrintAndLogEx(DEBUG, "DEBUG: Error - ZX: ans: %d", ans);
 
         restore_graphbuffer(saveState);
+        free_buffer_savestate(saveState);
         return PM3_ESOFT;
     }
     setDemodBuff(g_DemodBuffer, 96, ans);
@@ -78,6 +80,7 @@ int demodzx(bool verbose) {
     // test checksums
 
     PrintAndLogEx(SUCCESS, "ZX8211 - Card " _GREEN_("%u"), raw1);
+    free_buffer_savestate(saveState);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/graph.c b/client/src/graph.c
index 8df84d829..46c6a3309 100644
--- a/client/src/graph.c
+++ b/client/src/graph.c
@@ -666,3 +666,8 @@ void restore_graphbuffer(buffer_savestate_t saveState) {
     g_GraphTraceLen = len;
     g_GridOffset = saveState.offset;
 }
+
+// restore_*() copy out of the save state, the owner frees it after its last restore
+void free_buffer_savestate(buffer_savestate_t saveState) {
+    free((void *)saveState.buffer);
+}
diff --git a/client/src/graph.h b/client/src/graph.h
index 1a46d6362..ea0670ff1 100644
--- a/client/src/graph.h
+++ b/client/src/graph.h
@@ -69,6 +69,7 @@ size_t restore_buffer8(buffer_savestate_t saveState, uint8_t *dest);
 
 buffer_savestate_t save_graphbuffer(void);
 void restore_graphbuffer(buffer_savestate_t saveState);
+void free_buffer_savestate(buffer_savestate_t saveState);
 
 #define MAX_GRAPH_TRACE_LEN (40000 * 32)
 #define GRAPH_SAVE 1