CVE-2026-47558 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory s… |
CVE-2026-89078 | Critical | 9.9 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
CVE-2026-6794 | High | 7.8 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corru… |
CVE-2026-91018 | High | 8.8 | 2026-09-22 | lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim syst… |
CVE-2026-11388 | | | 2026-09-22 | Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7… |
CVE-2026-17050 | Medium | 5.7 | 2026-09-21 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_c… |
CVE-2026-20135 | High | 8.6 | 2026-09-16 | A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2026-84561 | Critical | 9.8 | 2026-09-14 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84558 | Medium | 5.5 | 2026-09-14 | A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system t… |
CVE-2026-85921 | High | 8.2 | 2026-09-14 | Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
CVE-2026-23790 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the… |
CVE-2026-23789 | High | 7.8 | 2026-09-14 | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600… |
CVE-2026-57842 | High | 7.0 | 2026-09-11 | NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return stat… |
CVE-2026-61915 | Medium | 4.2 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker wi… |
CVE-2026-87585 | High | 8.8 | 2026-09-09 | Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox… |
CVE-2026-79907 | High | 7.8 | 2026-09-08 | Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of thi… |
CVE-2026-81950 | High | 7.8 | 2026-09-08 | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-80080 | High | 8.8 | 2026-09-08 | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-77504 | High | 8.8 | 2026-09-08 | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-77493 | Critical | 9.8 | 2026-09-08 | Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-72958 | High | 8.2 | 2026-09-08 | Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally. |
CVE-2026-71353 | High | 7.0 | 2026-09-08 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-71351 | High | 7.0 | 2026-09-08 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-71338 | Medium | 6.4 | 2026-09-08 | Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. |
CVE-2026-70567 | High | 7.0 | 2026-09-08 | Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-70562 | High | 7.0 | 2026-09-08 | Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-69876 | High | 8.0 | 2026-09-08 | Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. |
CVE-2026-69725 | High | 7.8 | 2026-09-08 | Double free in Windows Hello allows an authorized attacker to elevate privileges locally. |
CVE-2026-69398 | High | 7.0 | 2026-09-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to eleva… |
CVE-2026-69337 | High | 7.1 | 2026-09-08 | Double free in Windows Registry allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69322 | High | 8.0 | 2026-09-08 | Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69309 | High | 7.0 | 2026-09-08 | Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
CVE-2026-69292 | High | 7.0 | 2026-09-08 | Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-55007 | High | 8.1 | 2026-09-08 | Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-82325 | | | 2026-09-07 | A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via craf… |
CVE-2026-20510 | Medium | 6.7 | 2026-09-07 | In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-33630 | High | 7.5 | 2026-09-03 | c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw —… |
CVE-2026-84964 | Medium | 5.9 | 2026-09-03 | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already tr… |
CVE-2026-52023 | High | 7.5 | 2026-09-01 | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_p… |
CVE-2026-82677 | Low | 2.4 | 2026-08-31 | A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Su… |
CVE-2026-19316 | | | 2026-08-28 | A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition i… |
CVE-2026-75159 | Medium | 5.9 | 2026-08-27 | An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a… |
CVE-2026-18798 | High | 7.5 | 2026-08-25 | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
when channel creation fails for initial packet.
Impact summary: Double free leads… |
CVE-2026-47895 | High | 7.5 | 2026-08-22 | In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly clone… |
CVE-2026-45202 | Medium | 5.5 | 2026-08-21 | Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption.
Scenario… |
CVE-2026-63652 | Medium | 6.5 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees cont… |
CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-65780 | High | 7.0 | 2026-08-11 | Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
CVE-2026-62889 | High | 8.1 | 2026-08-11 | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
CVE-2026-62766 | High | 7.0 | 2026-08-11 | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
CVE-2026-61366 | High | 7.0 | 2026-08-11 | Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
CVE-2026-11894 | Medium | 5.9 | 2026-08-11 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership con… |
CVE-2026-11893 | Medium | 5.9 | 2026-08-11 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_… |
CVE-2026-20338 | High | 7.5 | 2026-08-07 | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vul… |
CVE-2026-43622 | High | 7.8 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() wh… |
CVE-2026-55995 | | | 2026-07-29 | A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.
This issue affects open-iscsi: from ? through 56718d4e9d1… |
CVE-2026-17573 | Medium | 5.5 | 2026-07-27 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause… |
CVE-2026-64447 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix double-free and use-after-free in error paths
In both ipu7_isys… |
CVE-2026-64387 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix query directory replay double-free
A response-bearing attempt can return… |
CVE-2026-64386 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix query_info() replay double-free
A response-bearing attempt can return a… |
CVE-2026-64385 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return… |
CVE-2026-64384 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix change notify replay double-free
A response-bearing attempt can return a… |
CVE-2026-64383 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_flush() replay
SMB2_flush() keeps its response buffe… |
CVE-2026-64382 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_open() replay
A response-bearing attempt can return… |
CVE-2026-64377 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
cpufreq: qcom-cpufreq-hw: Fix possible double free
qcom_cpufreq.data is allocated with de… |
CVE-2026-66373 | High | 7.5 | 2026-07-25 | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same… |
CVE-2026-66032 | High | 8.8 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH ser… |
CVE-2026-64242 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: net2280: Fix double free in probe error path
usb_initialize_gadget() install… |
CVE-2026-64224 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix double free in rvu_rep_rsrc_init()
rvu_rep_rsrc_init() allocates queue… |
CVE-2026-64222 | High | 7.0 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: avoid double free of pool->stack on AQ init failure
otx2_pool_aq_init() fre… |
CVE-2026-43823 | High | 7.5 | 2026-07-23 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This ca… |
CVE-2026-64832 | High | 8.8 | 2026-07-22 | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to t… |
CVE-2026-64621 | High | 7.3 | 2026-07-20 | FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c)… |
CVE-2026-64118 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
qed: fix double free in qed_cxt_tables_alloc()
If one of the later PF or VF CID bitmap al… |
CVE-2026-64054 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
net: shaper: reject duplicate leaves in GROUP request
net_shaper_nl_group_doit() does not… |
CVE-2026-13713 | Medium | 6.2 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.
In the bundled… |
CVE-2026-55132 | High | 7.8 | 2026-07-14 | Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-50685 | High | 7.5 | 2026-07-14 | Double free in Windows DHCP Server allows an authorized attacker to execute code over a network. |
CVE-2026-50361 | High | 7.8 | 2026-07-14 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-55004 | High | 7.8 | 2026-07-14 | Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. |
CVE-2026-12659 | | | 2026-07-14 | A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing c… |
CVE-2025-15667 | Low | 3.3 | 2026-07-06 | A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of… |
CVE-2026-14604 | Medium | 6.3 | 2026-07-03 | A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetL… |
CVE-2026-8925 | Critical | 9.8 | 2026-07-03 | The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free(… |
CVE-2026-58381 | Medium | 6.1 | 2026-07-02 | A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP fi… |
CVE-2026-10653 | Medium | 6.4 | 2026-06-30 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the star… |
CVE-2026-14164 | High | 7.5 | 2026-06-30 | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain st… |
CVE-2026-43706 | Medium | 6.5 | 2026-06-29 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-53322 | High | 8.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Clean up DMABUFs before disabling function
On device shutdown, make vfio_pci_co… |
CVE-2026-53294 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
mailbox: mailbox-test: don't free the reused channel
The RX channel can be aliased to the… |
CVE-2026-53286 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_… |
CVE-2026-53233 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
netdev: fix double-free in netdev_nl_bind_rx_doit()
Sashiko flags that genlmsg_reply() al… |
CVE-2026-53067 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
pci_epf_alloc_doorbe… |
CVE-2026-53009 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in
… |
CVE-2026-52993 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append()
tipc_msg_validate() can potentially reallocate… |
CVE-2026-55653 | Medium | 4.3 | 2026-06-23 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occ… |
CVE-2026-56109 | Medium | 6.8 | 2026-06-22 | The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-12043 | High | 8.8 | 2026-06-12 | Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to caus… |
CVE-2026-46690 | Medium | 5.8 | 2026-06-12 | unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB read and fake… |