CWE-416 · Use After Free (page 15)
Page 15 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27925 | Medium | 6.5 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-27924 | High | 7.8 | 2026-04-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-27923 | High | 7.8 | 2026-04-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-27922 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-27921 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-27917 | High | 7.0 | 2026-04-14 | Use after free in Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-27916 | High | 7.8 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
CVE-2026-27915 | High | 7.8 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
CVE-2026-27911 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-27909 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-27908 | High | 7.0 | 2026-04-14 | Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-26182 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-26181 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26177 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-26174 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to e… |
CVE-2026-26173 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26172 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-26168 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26167 | High | 8.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-26165 | High | 7.0 | 2026-04-14 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-23657 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-27283 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-40311 | Medium | 5.5 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-f… |
CVE-2026-6100 | High | 8.1 | 2026-04-13 | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError… |
CVE-2025-69627 | High | 8.4 | 2026-04-13 | Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During executio… |
CVE-2026-31426 | High | 7.0 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers(… |
CVE-2026-31419 | High | 7.8 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses th… |
CVE-2026-34859 | Medium | 5.9 | 2026-04-13 | UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-34854 | Medium | 5.7 | 2026-04-13 | UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-6068 | Critical | 9.6 | 2026-04-10 | NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file… |
CVE-2026-5460 | Medium | 6.5 | 2026-04-10 | A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_Proce… |
CVE-2026-34734 | High | 7.8 | 2026-04-09 | HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicio… |
CVE-2026-34983 | Medium | 5.0 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by… |
CVE-2026-34757 | Medium | 5.1 | 2026-04-09 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to befor… |
CVE-2026-5883 | High | 8.8 | 2026-04-08 | Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5877 | High | 8.8 | 2026-04-08 | Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-5874 | Critical | 9.6 | 2026-04-08 | Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2026-5872 | High | 8.8 | 2026-04-08 | Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5866 | High | 8.8 | 2026-04-08 | Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5861 | High | 8.8 | 2026-04-08 | Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-5860 | High | 8.8 | 2026-04-08 | Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-28387 | High | 8.1 | 2026-04-07 | Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may r… |
CVE-2026-39316 | Medium | 4.0 | 2026-04-07 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerabili… |
CVE-2026-35554 | High | 8.7 | 2026-04-07 | A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a pro… |
CVE-2026-34764 | Low | 2.3 | 2026-04-06 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, a… |
CVE-2026-21380 | High | 7.8 | 2026-04-06 | Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory. |
CVE-2025-47374 | Medium | 6.5 | 2026-04-06 | Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling. |
CVE-2026-31408 | High | 8.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_… |
CVE-2026-34774 | High | 8.1 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that… |
CVE-2026-34772 | Medium | 5.8 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-34771 | High | 7.5 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-34770 | High | 7.0 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-be… |
CVE-2026-31399 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KA… |
CVE-2026-31396 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every openin… |
CVE-2026-31389 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sure to deregister from d… |
CVE-2026-23462 | High | 8.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: Fix possible UAF This fixes the following trace caused by not dropping l… |
CVE-2026-23461 | High | 8.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca (… |
CVE-2026-23458 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct… |
CVE-2026-23454 | High | 7.0 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A pote… |
CVE-2026-23450 | Critical | 9.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a pan… |
CVE-2026-23432 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix use-after-free in mshv_map_user_memory error path In the error path of mshv_map… |
CVE-2026-23428 | Critical | 9.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses… |
CVE-2026-23427 | Critical | 9.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in durable v2 replay of active file handles parse_durable_handl… |
CVE-2026-23415 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_… |
CVE-2026-23413 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the… |
CVE-2026-23412 | High | 7.8 | 2026-04-02 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports… |
CVE-2026-23401 | Medium | 5.5 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When install… |
CVE-2026-5290 | Critical | 9.6 | 2026-04-01 | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-5289 | Critical | 9.6 | 2026-04-01 | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-5288 | Critical | 9.6 | 2026-04-01 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-5287 | High | 8.8 | 2026-04-01 | Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Ch… |
CVE-2026-5286 | High | 8.8 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
CVE-2026-5285 | High | 8.8 | 2026-04-01 | Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5284 | High | 7.5 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
CVE-2026-5281 | High | 8.8 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
CVE-2026-5280 | High | 8.8 | 2026-04-01 | Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-5278 | High | 8.8 | 2026-04-01 | Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-5273 | Medium | 6.3 | 2026-04-01 | Use after free in CSS in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-3779 | High | 7.8 | 2026-04-01 | The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted docu… |
CVE-2026-3777 | Medium | 5.5 | 2026-04-01 | The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state… |
CVE-2026-27854 | Medium | 4.8 | 2026-03-31 | An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua cod… |
CVE-2026-27309 | High | 7.8 | 2026-03-27 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2024-14028 | Medium | 6.5 | 2026-03-27 | Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: through 1.31 smartLi… |
CVE-2026-33416 | High | 7.5 | 2026-03-26 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 t… |
CVE-2026-27828 | High | 7.5 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO1… |
CVE-2026-27813 | Medium | 5.3 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RF… |
CVE-2026-26071 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free pos… |
CVE-2026-33526 | High | 7.5 | 2026-03-26 | Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. Thi… |
CVE-2026-32748 | High | 7.5 | 2026-03-26 | Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid i… |
CVE-2026-28529 | High | 7.8 | 2026-03-25 | cryptodev-linux version 1.14 and prior contain a page reference handling flaw in the get_userbuf function of the /dev/crypto device driver that allows local us… |
CVE-2026-23392 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_… |
CVE-2026-23351 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use… |
CVE-2026-23344 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked()… |
CVE-2026-23340 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrink… |
CVE-2026-23336 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free… |
CVE-2026-23322 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: Wh… |
CVE-2026-23319 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is tha… |
CVE-2026-23306 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm… |
CVE-2026-23281 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function… |
CVE-2026-28879 | Medium | 6.5 | 2026-03-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequ… |