CWE-416 · Use After Free (page 14)
Page 14 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53117 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is probed through __dr… |
CVE-2026-53116 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks are updated via apm… |
CVE-2026-53115 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through _… |
CVE-2026-53112 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_taskl… |
CVE-2026-53109 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcoun… |
CVE-2026-53098 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci… |
CVE-2026-53097 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci… |
CVE-2026-53089 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offload… |
CVE-2026-53085 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator re… |
CVE-2026-53071 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp(… |
CVE-2026-53055 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission… |
CVE-2026-53046 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message… |
CVE-2026-53040 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an ou… |
CVE-2026-53033 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sock… |
CVE-2026-53025 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a… |
CVE-2026-53024 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to… |
CVE-2026-53011 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sc… |
CVE-2026-53010 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to… |
CVE-2026-53009 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in … |
CVE-2026-53006 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is prob… |
CVE-2026-53005 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX G… |
CVE-2026-52982 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN sla… |
CVE-2026-52976 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist… |
CVE-2026-52973 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_… |
CVE-2026-52971 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check a… |
CVE-2026-52951 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when… |
CVE-2026-52950 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed o… |
CVE-2026-52947 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_rem… |
CVE-2026-52943 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_heade… |
CVE-2026-52924 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked w… |
CVE-2026-52912 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->d… |
CVE-2026-56117 | Medium | 4.7 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows lo… |
CVE-2026-56113 | Medium | 5.3 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemo… |
CVE-2026-56376 | Low | 3.7 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale p… |
CVE-2026-6653 | Critical | 9.8 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via malici… |
CVE-2026-56412 | Medium | 4.9 | 2026-06-21 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers… |
CVE-2026-12706 | Medium | 6.5 | 2026-06-19 | A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but… |
CVE-2026-11941 | Medium | 5.6 | 2026-06-19 | Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “qu… |
CVE-2026-41156 | High | 7.7 | 2026-06-19 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free s… |
CVE-2026-34192 | High | 7.7 | 2026-06-19 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vuln… |
CVE-2026-56131 | Medium | 4.9 | 2026-06-19 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-fr… |
CVE-2026-11791 | Medium | 5.0 | 2026-06-18 | A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, by… |
CVE-2026-9158 | Critical | 9.8 | 2026-06-18 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This… |
CVE-2026-42530 | High | 8.1 | 2026-06-17 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenti… |
CVE-2026-12467 | High | 8.3 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12464 | High | 8.3 | 2026-06-17 | Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-12462 | High | 7.5 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code i… |
CVE-2026-12455 | High | 7.5 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potent… |
CVE-2026-12452 | High | 8.8 | 2026-06-17 | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-12451 | High | 8.3 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12449 | High | 7.8 | 2026-06-17 | Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malici… |
CVE-2026-12445 | High | 7.5 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-12443 | High | 8.8 | 2026-06-17 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-12442 | High | 8.8 | 2026-06-17 | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-12441 | High | 8.8 | 2026-06-17 | Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12440 | Critical | 9.6 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-12439 | High | 8.8 | 2026-06-17 | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12437 | High | 8.3 | 2026-06-17 | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-0143 | High | 7.8 | 2026-06-16 | In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi… |
CVE-2026-0137 | High | 7.8 | 2026-06-16 | In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escala… |
CVE-2026-0125 | High | 7.0 | 2026-06-16 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addi… |
CVE-2026-10640 | Medium | 4.2 | 2026-06-16 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-s… |
CVE-2026-10639 | Medium | 4.8 | 2026-06-16 | In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and… |
CVE-2026-10638 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and… |
CVE-2026-10637 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ow… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12293 | Critical | 9.8 | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12291 | High | 8.8 | 2026-06-16 | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-10635 | Medium | 6.3 | 2026-06-16 | On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of… |
CVE-2025-55650 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55644 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2026-6040 | High | 7.3 | 2026-06-15 | A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked agains… |
CVE-2026-10634 | Medium | 4.8 | 2026-06-15 | Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, whi… |
CVE-2026-41158 | High | 7.8 | 2026-06-12 | Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memory allocated and f… |
CVE-2026-11933 | High | 8.8 | 2026-06-12 | A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated u… |
CVE-2026-12035 | High | 8.8 | 2026-06-11 | Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-12029 | High | 8.3 | 2026-06-11 | Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-12028 | High | 8.3 | 2026-06-11 | Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-12023 | High | 8.3 | 2026-06-11 | Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12020 | High | 8.8 | 2026-06-11 | Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-12015 | Medium | 5.3 | 2026-06-11 | Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially se… |
CVE-2026-12014 | High | 8.3 | 2026-06-11 | Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sandbox escape via ma… |
CVE-2026-12012 | High | 8.1 | 2026-06-11 | Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption… |
CVE-2026-12011 | High | 8.3 | 2026-06-11 | Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12008 | High | 8.3 | 2026-06-11 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12007 | High | 8.8 | 2026-06-11 | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromi… |
CVE-2026-53462 | Medium | 5.9 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fai… |
CVE-2026-46523 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image ca… |
CVE-2026-52757 | Medium | 4.4 | 2026-06-10 | Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers… |
CVE-2026-49496 | Medium | 6.1 | 2026-06-10 | Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocate… |
CVE-2026-45782 | | 2026-06-10 | Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hy… | |
CVE-2026-47955 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47924 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2026-47921 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47920 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47919 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |