CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-65780 | High | 7.0 | 2026-08-11 | Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
CVE-2026-62889 | High | 8.1 | 2026-08-11 | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
CVE-2026-62766 | High | 7.0 | 2026-08-11 | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
CVE-2026-61366 | High | 7.0 | 2026-08-11 | Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
CVE-2026-11894 | Medium | 5.9 | 2026-08-11 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership con… |
CVE-2026-11893 | Medium | 5.9 | 2026-08-11 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_… |
CVE-2026-20338 | High | 7.5 | 2026-08-07 | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vul… |
CVE-2026-43622 | High | 7.8 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() wh… |
CVE-2026-55995 | | | 2026-07-29 | A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.
This issue affects open-iscsi: from ? through 56718d4e9d1… |
CVE-2026-17573 | | | 2026-07-27 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause… |
CVE-2026-66373 | High | 7.5 | 2026-07-25 | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same… |
CVE-2026-66032 | High | 8.8 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH ser… |
CVE-2026-64242 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: net2280: Fix double free in probe error path
usb_initialize_gadget() install… |
CVE-2026-64224 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix double free in rvu_rep_rsrc_init()
rvu_rep_rsrc_init() allocates queue… |
CVE-2026-64222 | High | 7.0 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: avoid double free of pool->stack on AQ init failure
otx2_pool_aq_init() fre… |
CVE-2026-43823 | High | 7.5 | 2026-07-23 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This ca… |
CVE-2026-64832 | High | 8.8 | 2026-07-22 | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to t… |
CVE-2026-64621 | High | 7.3 | 2026-07-20 | FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c)… |
CVE-2026-64118 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
qed: fix double free in qed_cxt_tables_alloc()
If one of the later PF or VF CID bitmap al… |
CVE-2026-13713 | Medium | 6.2 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.
In the bundled… |
CVE-2026-55132 | High | 7.8 | 2026-07-14 | Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-50685 | High | 7.5 | 2026-07-14 | Double free in Windows DHCP Server allows an authorized attacker to execute code over a network. |
CVE-2026-50361 | High | 7.8 | 2026-07-14 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-55004 | High | 7.8 | 2026-07-14 | Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. |
CVE-2026-12659 | | | 2026-07-14 | A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing c… |
CVE-2025-15667 | Low | 3.3 | 2026-07-06 | A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of… |
CVE-2026-14604 | Medium | 6.3 | 2026-07-03 | A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetL… |
CVE-2026-8925 | Critical | 9.8 | 2026-07-03 | The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free(… |
CVE-2026-58381 | Medium | 6.1 | 2026-07-02 | A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP fi… |
CVE-2026-10653 | Medium | 6.4 | 2026-06-30 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the star… |
CVE-2026-14164 | High | 7.5 | 2026-06-30 | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain st… |
CVE-2026-43706 | Medium | 6.5 | 2026-06-29 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-53322 | High | 8.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Clean up DMABUFs before disabling function
On device shutdown, make vfio_pci_co… |
CVE-2026-53294 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
mailbox: mailbox-test: don't free the reused channel
The RX channel can be aliased to the… |
CVE-2026-53286 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_… |
CVE-2026-53233 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
netdev: fix double-free in netdev_nl_bind_rx_doit()
Sashiko flags that genlmsg_reply() al… |
CVE-2026-53067 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
pci_epf_alloc_doorbe… |
CVE-2026-53009 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in
… |
CVE-2026-52993 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append()
tipc_msg_validate() can potentially reallocate… |
CVE-2026-55653 | Medium | 4.3 | 2026-06-23 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occ… |
CVE-2026-56109 | Medium | 6.8 | 2026-06-22 | The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-12043 | High | 8.8 | 2026-06-12 | Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to caus… |
CVE-2026-46690 | Medium | 5.8 | 2026-06-12 | unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB read and fake… |
CVE-2026-35188 | Medium | 5.0 | 2026-06-09 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering
a crafted response through the status_request extension, triggering a
double-free… |
CVE-2026-46279 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved:
mm/alloc_tag: clear codetag for pages allocated before page_ext initialization
Due to ini… |
CVE-2026-45324 | Low | 3.3 | 2026-05-29 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wr… |
CVE-2026-44422 | High | 7.5 | 2026-05-29 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multi… |
CVE-2026-46189 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
Sashiko points out… |
CVE-2026-46183 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
damon_sysfs_quot_goal-… |
CVE-2026-46164 | High | 7.0 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix double free in create_space_info_sub_group() error path
When kobject_init_and_… |
CVE-2026-46162 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
ice: fix double free in ice_sf_eth_activate() error path
When auxiliary_device_add() fail… |
CVE-2026-46129 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix double free in create_space_info() error path
When kobject_init_and_add() fail… |
CVE-2026-45920 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix dirtyclusters double decrement on fs shutdown
fstests test generic/388 occasion… |
CVE-2026-45891 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
net: hns3: fix double free issue for tx spare buffer
In hns3_set_ringparam(), a temporary… |
CVE-2026-45852 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix double free in rxe_srq_from_init
In rxe_srq_from_init(), the queue pointer… |
CVE-2026-48850 | Low | 3.7 | 2026-05-25 | PuTTY 0.72 before 0.84 has a double free in RSA KEX. |
CVE-2026-32848 | Medium | 4.7 | 2026-05-18 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger… |
CVE-2020-37239 | Critical | 9.8 | 2026-05-16 | libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting i… |
CVE-2026-44348 | Low | 2.5 | 2026-05-14 | PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/Open… |
CVE-2026-34341 | High | 7.0 | 2026-05-12 | Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally. |
CVE-2026-33838 | High | 7.8 | 2026-05-12 | Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2026-32170 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-21530 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-43460 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
spi: rockchip-sfc: Fix double-free in remove() callback
The driver uses devm_spi_register… |
CVE-2026-43414 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xx_els_dcmd_iocb() sp->free is s… |
CVE-2026-43328 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
When kobject… |
CVE-2026-33811 | High | 7.5 | 2026-05-07 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. |
CVE-2026-43278 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
dm: clear cloned request bio pointer when last clone bio completes
Stale rq->bio values h… |
CVE-2026-43276 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix double destroy_workqueue on service rescan PCI path
While testing corner c… |
CVE-2026-43260 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix RSS context delete logic
We need to free the corresponding RSS context VNIC
… |
CVE-2026-43249 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
9p/xen: protect xen_9pfs_front_free against concurrent calls
The xenwatch thread can race… |
CVE-2026-43196 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
In the pruss_clk_mux_setup(), th… |
CVE-2026-43178 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
procfs: fix possible double mmput() in do_procmap_query()
When user provides incorrectly… |
CVE-2026-43128 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix double dma_buf_unpin in failure path
In ib_umem_dmabuf_get_pinned_with_dma… |
CVE-2026-43120 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix double free related to rereg_user_mr
If IB_MR_REREG_TRANS is set during r… |
CVE-2026-43097 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
PCI: hv: Fix double ida_free in hv_pci_probe error path
If hv_pci_probe() fails after sto… |
CVE-2026-23918 | High | 8.8 | 2026-05-04 | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommend… |
CVE-2026-43011 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
net/x25: Fix potential double free of skb
When alloc_skb fails in x25_queue_rx_frame it c… |
CVE-2026-43007 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Handle DBC deactivation if the owner went away
When a DBC is released, the de… |
CVE-2026-31759 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
usb: ulpi: fix double free in ulpi_register_interface() error path
When device_register()… |
CVE-2026-31745 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
reset: gpio: fix double free in reset_add_gpio_aux_device() error path
When __auxiliary_d… |
CVE-2026-31730 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: possible double-free of cctx->remote_heap
fastrpc_init_create_static_proce… |
CVE-2026-31787 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved:
xen/privcmd: fix double free via VMA splitting
privcmd_vm_ops defines .close (privcmd_clo… |
CVE-2026-5657 | Medium | 5.5 | 2026-04-30 | iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-31686 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved:
mm/kasan: fix double free for kasan pXds
kasan_free_pxd() assumes the page table is alway… |
CVE-2026-31609 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
smbd_… |
CVE-2026-31608 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved:
smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list… |
CVE-2026-31507 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
smc_rx_… |
CVE-2026-31506 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: fix double free of WoL irq
We do not need to free wol_irq since it was insta… |
CVE-2026-31489 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
spi: meson-spicc: Fix double-put in remove path
meson_spicc_probe() registers the control… |
CVE-2026-31475 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
ASoC: sma1307: fix double free of devm_kzalloc() memory
A previous change added NULL chec… |
CVE-2026-31471 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: only publish mode_data after clone setup
iptfs_clone_state() stores x->mode_… |
CVE-2026-31468 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Fix double free in dma-buf feature
The error path through vfio_pci_core_feature… |
CVE-2026-6654 | Medium | 5.1 | 2026-04-20 | Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting… |
CVE-2026-33824 | Critical | 9.8 | 2026-04-14 | Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
CVE-2026-32219 | High | 7.0 | 2026-04-14 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32074 | High | 7.8 | 2026-04-14 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32069 | High | 7.8 | 2026-04-14 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |