CWE-416 · Use After Free (page 16)
Page 16 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28879 | Medium | 6.5 | 2026-03-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequ… |
CVE-2026-28859 | Medium | 4.3 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4… |
CVE-2026-28857 | Medium | 6.5 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processin… |
CVE-2026-28835 | Medium | 6.5 | 2026-03-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Mount… |
CVE-2026-20687 | High | 7.1 | 2026-03-25 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequ… |
CVE-2026-20637 | Medium | 6.2 | 2026-03-25 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequ… |
CVE-2026-4725 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4723 | Critical | 9.8 | 2026-03-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4711 | Critical | 9.8 | 2026-03-24 | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4701 | Critical | 9.8 | 2026-03-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4696 | Critical | 9.8 | 2026-03-24 | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, an… |
CVE-2026-4691 | Critical | 9.8 | 2026-03-24 | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 14… |
CVE-2026-4688 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149… |
CVE-2026-4684 | High | 7.5 | 2026-03-24 | Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunde… |
CVE-2026-4752 | Medium | 6.4 | 2026-03-24 | Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329. |
CVE-2026-4737 | | 2026-03-24 | Use After Free vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/mm modules). This vulnerability is associated with program files rma… | |
CVE-2026-4680 | High | 8.8 | 2026-03-24 | Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-4678 | High | 8.8 | 2026-03-24 | Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-4676 | High | 8.8 | 2026-03-24 | Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-30007 | Medium | 6.2 | 2026-03-23 | XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file |
CVE-2026-33150 | High | 7.8 | 2026-03-20 | libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsyst… |
CVE-2026-23273 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reporte… |
CVE-2026-32942 | High | 8.1 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE… |
CVE-2026-4458 | High | 8.8 | 2026-03-20 | Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-4456 | High | 8.8 | 2026-03-20 | Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-4454 | High | 8.8 | 2026-03-20 | Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-4449 | High | 8.8 | 2026-03-20 | Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-4446 | High | 8.8 | 2026-03-20 | Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-4445 | High | 8.8 | 2026-03-20 | Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-4441 | High | 8.8 | 2026-03-20 | Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-31972 | Critical | 9.8 | 2026-03-18 | SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned aga… |
CVE-2026-23270 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo… |
CVE-2026-23248 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_… |
CVE-2026-4148 | High | 8.8 | 2026-03-17 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $grap… |
CVE-2026-4271 | Medium | 5.3 | 2026-03-17 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A… |
CVE-2026-32724 | Medium | 5.3 | 2026-03-16 | PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The is… |
CVE-2026-3979 | Medium | 5.3 | 2026-03-12 | A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes u… |
CVE-2026-3936 | High | 8.8 | 2026-03-11 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-3924 | High | 7.5 | 2026-03-11 | use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-3923 | High | 8.8 | 2026-03-11 | Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3922 | High | 8.8 | 2026-03-11 | Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3921 | High | 8.8 | 2026-03-11 | Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3919 | High | 8.8 | 2026-03-11 | Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2026-3918 | High | 8.8 | 2026-03-11 | Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3917 | High | 8.8 | 2026-03-11 | Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3805 | High | 7.5 | 2026-03-11 | When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. |
CVE-2026-27278 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-27220 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0112 | High | 7.4 | 2026-03-10 | In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2026-26330 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with… |
CVE-2026-26311 | Medium | 5.9 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (… |
CVE-2026-27277 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27276 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-3847 | High | 8.8 | 2026-03-10 | Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-26134 | High | 7.8 | 2026-03-10 | Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-26132 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26107 | High | 7.8 | 2026-03-10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-25189 | High | 7.8 | 2026-03-10 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-25178 | High | 7.0 | 2026-03-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25171 | High | 7.0 | 2026-03-10 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2026-25170 | High | 7.0 | 2026-03-10 | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-25167 | High | 7.4 | 2026-03-10 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24292 | High | 7.8 | 2026-03-10 | Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2026-24289 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-24285 | High | 7.0 | 2026-03-10 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-23671 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized att… |
CVE-2026-23669 | High | 8.8 | 2026-03-10 | Use after free in RPC Runtime allows an authorized attacker to execute code over a network. |
CVE-2026-23667 | High | 7.0 | 2026-03-10 | Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally. |
CVE-2026-28688 | Medium | 4.0 | 2026-03-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free… |
CVE-2026-28687 | Medium | 5.3 | 2026-03-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free… |
CVE-2026-28799 | High | 7.5 | 2026-03-06 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's eve… |
CVE-2025-13350 | | 2026-03-05 | Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When… | |
CVE-2026-22040 | Medium | 5.3 | 2026-03-04 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes a… |
CVE-2026-23234 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue… |
CVE-2026-23231 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() pub… |
CVE-2026-0027 | Medium | 6.7 | 2026-03-02 | In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with Sys… |
CVE-2025-47386 | High | 7.8 | 2026-03-02 | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47381 | High | 7.8 | 2026-03-02 | Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47379 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
CVE-2025-47377 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
CVE-2025-47376 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
CVE-2025-47375 | High | 7.8 | 2026-03-02 | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
CVE-2026-20443 | Medium | 6.7 | 2026-03-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20442 | Medium | 4.4 | 2026-03-02 | In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sy… |
CVE-2026-20439 | Medium | 4.4 | 2026-03-02 | In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sys… |
CVE-2026-20437 | Medium | 4.4 | 2026-03-02 | In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System… |
CVE-2026-27950 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is in… |
CVE-2026-26986 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during… |
CVE-2026-25997 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory beca… |
CVE-2026-25959 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangePropert… |
CVE-2026-25955 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data`… |
CVE-2026-25954 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` p… |
CVE-2026-25953 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` beca… |
CVE-2026-25952 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer b… |
CVE-2026-2804 | Medium | 5.4 | 2026-02-24 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2799 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2798 | High | 8.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |