CWE-415 · Double Free (page 2)
Page 2 of 9 — CVEs classified under CWE-415, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35188 | Medium | 5.0 | 2026-06-09 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free… |
CVE-2026-46279 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Due to ini… |
CVE-2026-45324 | Low | 3.3 | 2026-05-29 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wr… |
CVE-2026-44422 | High | 7.5 | 2026-05-29 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multi… |
CVE-2026-46189 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out… |
CVE-2026-46183 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damon_sysfs_quot_goal-… |
CVE-2026-46164 | High | 7.0 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_… |
CVE-2026-46162 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fail… |
CVE-2026-46129 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info() error path When kobject_init_and_add() fail… |
CVE-2026-45920 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasion… |
CVE-2026-45891 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary… |
CVE-2026-45852 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer… |
CVE-2026-48850 | Low | 3.7 | 2026-05-25 | PuTTY 0.72 before 0.84 has a double free in RSA KEX. |
CVE-2026-32848 | Medium | 4.7 | 2026-05-18 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger… |
CVE-2020-37239 | Critical | 9.8 | 2026-05-16 | libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting i… |
CVE-2026-44348 | Low | 2.5 | 2026-05-14 | PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/Open… |
CVE-2026-34341 | High | 7.0 | 2026-05-12 | Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally. |
CVE-2026-33838 | High | 7.8 | 2026-05-12 | Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2026-32170 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-21530 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-43460 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fix double-free in remove() callback The driver uses devm_spi_register… |
CVE-2026-43414 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is s… |
CVE-2026-43328 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject… |
CVE-2026-33811 | High | 7.5 | 2026-05-07 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. |
CVE-2026-43278 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values h… |
CVE-2026-43276 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner c… |
CVE-2026-43260 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC … |
CVE-2026-43249 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: 9p/xen: protect xen_9pfs_front_free against concurrent calls The xenwatch thread can race… |
CVE-2026-43196 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: soc: ti: pruss: Fix double free in pruss_clk_mux_setup() In the pruss_clk_mux_setup(), th… |
CVE-2026-43178 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly… |
CVE-2026-43128 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma… |
CVE-2026-43120 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during r… |
CVE-2026-43097 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: PCI: hv: Fix double ida_free in hv_pci_probe error path If hv_pci_probe() fails after sto… |
CVE-2026-23918 | High | 8.8 | 2026-05-04 | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommend… |
CVE-2026-43011 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it c… |
CVE-2026-43007 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the de… |
CVE-2026-31759 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register()… |
CVE-2026-31745 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: reset: gpio: fix double free in reset_add_gpio_aux_device() error path When __auxiliary_d… |
CVE-2026-31730 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_proce… |
CVE-2026-31787 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_clo… |
CVE-2026-5657 | Medium | 5.5 | 2026-04-30 | iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-31686 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: mm/kasan: fix double free for kasan pXds kasan_free_pxd() assumes the page table is alway… |
CVE-2026-31609 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_… |
CVE-2026-31608 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list… |
CVE-2026-31507 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_… |
CVE-2026-31506 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix double free of WoL irq We do not need to free wol_irq since it was insta… |
CVE-2026-31489 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: spi: meson-spicc: Fix double-put in remove path meson_spicc_probe() registers the control… |
CVE-2026-31475 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL chec… |
CVE-2026-31471 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_… |
CVE-2026-31468 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Fix double free in dma-buf feature The error path through vfio_pci_core_feature… |
CVE-2026-6654 | Medium | 5.1 | 2026-04-20 | Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting… |
CVE-2026-33824 | Critical | 9.8 | 2026-04-14 | Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
CVE-2026-32219 | High | 7.0 | 2026-04-14 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32074 | High | 7.8 | 2026-04-14 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32069 | High | 7.8 | 2026-04-14 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26179 | High | 7.8 | 2026-04-14 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26166 | High | 7.0 | 2026-04-14 | Double free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-26163 | High | 7.8 | 2026-04-14 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-34867 | Medium | 5.6 | 2026-04-13 | Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-31053 | Medium | 6.2 | 2026-04-06 | A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, r… |
CVE-2026-23449 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockle… |
CVE-2026-23408 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 10… |
CVE-2026-5186 | Medium | 5.3 | 2026-03-31 | A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame G… |
CVE-2026-33995 | Medium | 5.3 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and k… |
CVE-2026-23387 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() devm_add_action_or_reset(… |
CVE-2026-4358 | Medium | 6.4 | 2026-03-17 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the… |
CVE-2026-23868 | Medium | 5.1 | 2026-03-10 | Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to tr… |
CVE-2025-69650 | High | 7.5 | 2026-03-06 | GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation… |
CVE-2026-28537 | Medium | 5.1 | 2026-03-05 | Double free vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-71238 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353… |
CVE-2025-61145 | Medium | 5.0 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c. |
CVE-2025-12343 | Low | 3.3 | 2026-02-18 | A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, w… |
CVE-2026-23162 | High | 7.8 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init()… |
CVE-2026-25556 | High | 7.5 | 2026-02-06 | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list ren… |
CVE-2026-23098 | High | 8.8 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately f… |
CVE-2026-23068 | High | 7.8 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-sprd-adi: Fix double free in probe error path The driver currently uses spi_allo… |
CVE-2026-20415 | Medium | 5.5 | 2026-02-02 | In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor has already obtained… |
CVE-2025-57785 | Medium | 6.5 | 2026-01-26 | A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may le… |
CVE-2026-21918 | High | 7.5 | 2026-01-15 | A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based at… |
CVE-2025-13844 | Medium | 5.3 | 2026-01-15 | CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the a… |
CVE-2025-68968 | High | 7.8 | 2026-01-14 | Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect the input function. |
CVE-2026-20867 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20863 | High | 7.0 | 2026-01-13 | Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-20861 | High | 7.8 | 2026-01-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20832 | High | 7.8 | 2026-01-13 | Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability |
CVE-2025-68657 | Medium | 6.4 | 2026-01-12 | Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same… |
CVE-2026-20026 | Medium | 5.8 | 2026-01-07 | Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to caus… |
CVE-2025-47396 | High | 7.8 | 2026-01-07 | Memory corruption occurs when a secure application is launched on a device with insufficient memory. |
CVE-2025-47356 | High | 7.8 | 2026-01-07 | Memory Corruption when multiple threads concurrently access and modify shared resources. |
CVE-2025-20801 | High | 7.0 | 2026-01-06 | In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obt… |
CVE-2025-20786 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20781 | High | 7.8 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-36919 | High | 7.8 | 2025-12-11 | In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with no additional… |
CVE-2025-62469 | High | 7.0 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-65955 | Medium | 4.9 | 2025-12-02 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in Imag… |
CVE-2025-13566 | Low | 3.3 | 2025-11-23 | A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of th… |
CVE-2025-62219 | High | 7.0 | 2025-11-11 | Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62215 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2025-59505 | High | 7.8 | 2025-11-11 | Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
CVE-2025-43282 | Medium | 5.5 | 2025-10-15 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS So… |