CWE-416 · Use After Free (page 14)
Page 14 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31644 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_relo… |
CVE-2026-31597 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop t… |
CVE-2026-31589 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_fre… |
CVE-2026-31588 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to u… |
CVE-2026-31587 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: move component registration to unmanaged version q6apm component regis… |
CVE-2026-31586 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls c… |
CVE-2026-31584 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_relea… |
CVE-2026-31583 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free in em28xx_v4l2_open() em28xx_v4l2_open() reads dev->v4l… |
CVE-2026-31582 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix use-after-free on USB disconnect After powerz_disconnect() frees the… |
CVE-2026-31581 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct i… |
CVE-2026-31580 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: bcache: fix cached_dev.sb_bio use-after-free and crash In our production environment, we… |
CVE-2026-31578 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: as102: fix to not free memory after the device is registered in as102_usb_probe() … |
CVE-2026-31576 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In… |
CVE-2026-31566 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib(… |
CVE-2026-31554 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags Nicholas reported that his LLM… |
CVE-2026-31541 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix trace_marker copy link list updates When the "copy_trace_marker" option is e… |
CVE-2026-6919 | Critical | 9.6 | 2026-04-23 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-31533 | Critical | 9.8 | 2026-04-23 | In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling… |
CVE-2026-31532 | High | 7.8 | 2026-04-23 | In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN rece… |
CVE-2026-31530 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called… |
CVE-2026-31527 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed… |
CVE-2026-31511 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixe… |
CVE-2026-31504 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race… |
CVE-2026-31501 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_p… |
CVE-2026-31500 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error(… |
CVE-2026-31493 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix use of completion ctx after free On admin queue completion handling, if the… |
CVE-2026-31490 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xe_srio… |
CVE-2026-31488 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commi… |
CVE-2026-31485 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the… |
CVE-2026-31474 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxch… |
CVE-2026-31473 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REIN… |
CVE-2026-31469 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false … |
CVE-2026-31455 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_f… |
CVE-2026-31454 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() an… |
CVE-2026-31446 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179… |
CVE-2026-31444 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two… |
CVE-2026-33259 | Medium | 5.0 | 2026-04-22 | Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfer… |
CVE-2026-5398 | High | 8.4 | 2026-04-22 | The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If th… |
CVE-2026-6784 | High | 7.5 | 2026-04-21 | Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-6759 | High | 7.5 | 2026-04-21 | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6758 | High | 7.5 | 2026-04-21 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6754 | High | 7.5 | 2026-04-21 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Th… |
CVE-2026-6747 | High | 7.5 | 2026-04-21 | Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6746 | High | 7.5 | 2026-04-21 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thu… |
CVE-2026-6654 | Medium | 5.1 | 2026-04-20 | Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting… |
CVE-2026-6362 | Medium | 4.3 | 2026-04-15 | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted vi… |
CVE-2026-6360 | High | 8.8 | 2026-04-15 | Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML pag… |
CVE-2026-6359 | High | 8.8 | 2026-04-15 | Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out o… |
CVE-2026-6358 | High | 8.8 | 2026-04-15 | Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-6319 | High | 7.5 | 2026-04-15 | Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-6318 | High | 8.8 | 2026-04-15 | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-6317 | High | 8.8 | 2026-04-15 | Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
CVE-2026-6316 | High | 8.8 | 2026-04-15 | Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-6315 | High | 8.8 | 2026-04-15 | Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-6310 | High | 8.3 | 2026-04-15 | Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-6309 | High | 8.3 | 2026-04-15 | Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-6304 | High | 8.3 | 2026-04-15 | Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-6303 | High | 8.8 | 2026-04-15 | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-6302 | High | 8.8 | 2026-04-15 | Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-6300 | High | 8.8 | 2026-04-15 | Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-6299 | High | 8.8 | 2026-04-15 | Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
CVE-2026-6297 | High | 8.3 | 2026-04-15 | Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape v… |
CVE-2026-33023 | High | 7.8 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built with the --with-gdk-pixbuf2 option, a us… |
CVE-2026-33021 | High | 7.3 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder… |
CVE-2026-27292 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2026-33018 | High | 7.0 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif… |
CVE-2026-33115 | High | 8.4 | 2026-04-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-33104 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-33101 | High | 7.8 | 2026-04-14 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
CVE-2026-33100 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-33099 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-33098 | High | 7.8 | 2026-04-14 | Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-33095 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-32224 | High | 7.0 | 2026-04-14 | Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-32200 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2026-32199 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-32198 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-32197 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-32190 | High | 8.4 | 2026-04-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-32189 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-32165 | High | 7.8 | 2026-04-14 | Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally. |
CVE-2026-32163 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-32159 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-32158 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-32157 | High | 8.8 | 2026-04-14 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-32156 | High | 7.4 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally. |
CVE-2026-32155 | High | 7.8 | 2026-04-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-32154 | High | 7.8 | 2026-04-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-32153 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2026-32152 | High | 7.8 | 2026-04-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-32091 | High | 8.4 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker… |
CVE-2026-32090 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to ele… |
CVE-2026-32089 | High | 7.8 | 2026-04-14 | Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally. |
CVE-2026-32080 | High | 7.0 | 2026-04-14 | Use after free in Windows WalletService allows an authorized attacker to elevate privileges locally. |
CVE-2026-32078 | High | 7.8 | 2026-04-14 | Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32075 | High | 7.0 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
CVE-2026-32073 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-32070 | High | 7.0 | 2026-04-14 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-27927 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to e… |
CVE-2026-27926 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized atta… |