CWE-416 · Use After Free (page 18)
Page 18 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10013 | High | 8.8 | 2026-05-28 | Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-10012 | High | 8.3 | 2026-05-28 | Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-10007 | High | 8.8 | 2026-05-28 | Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-10005 | High | 7.5 | 2026-05-28 | Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-10003 | High | 7.5 | 2026-05-28 | Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute ar… |
CVE-2026-10002 | High | 8.8 | 2026-05-28 | Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chr… |
CVE-2026-10001 | High | 8.3 | 2026-05-28 | Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-10000 | High | 8.3 | 2026-05-28 | Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-47331 | High | 7.8 | 2026-05-28 | Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race c… |
CVE-2026-46241 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration failure Make sure to disable and free th… |
CVE-2026-46240 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in c… |
CVE-2026-46227 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDAL… |
CVE-2026-46219 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on unbind The state machine work is scheduled by the int… |
CVE-2026-46215 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race… |
CVE-2026-46213 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 ("HID: app… |
CVE-2026-46212 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadv_bla_del_backbone… |
CVE-2026-46210 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing… |
CVE-2026-46180 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Watchdog t… |
CVE-2026-46166 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_ca… |
CVE-2026-46154 | High | 7.0 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters scx_group_set_{weig… |
CVE-2026-46125 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails f… |
CVE-2026-46121 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm… |
CVE-2026-46120 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ip… |
CVE-2026-46116 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-… |
CVE-2026-46113 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes… |
CVE-2026-46111 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in c… |
CVE-2026-4390 | Medium | 5.4 | 2026-05-27 | A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the component Connection State Management… |
CVE-2026-46097 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 - fix use-after-free in debugfs teardown The commit 68743c500c6e ("Inpu… |
CVE-2026-46090 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may s… |
CVE-2026-46084 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: Disable RX steering on RSS QP destroy When an RSS QP is destroyed (e.g. DPD… |
CVE-2026-46075 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Unregister the h… |
CVE-2026-46069 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanu… |
CVE-2026-46056 | High | 8.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field… |
CVE-2026-46047 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Fix use-after-free in driver remove() In the remove callback, if a packet… |
CVE-2026-46036 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio_cdx_set_msi_trigger… |
CVE-2026-46011 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: fix use-after-free in release path due to uncancelled work The mtk_jpeg_… |
CVE-2026-46004 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq dr… |
CVE-2026-45998 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a… |
CVE-2026-45996 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix use-after-free on unbind The SPI subsystem frees the controller and any sub… |
CVE-2026-45995 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_struct uaf io_free_rbuf_ring() usees a struct user_struct, which … |
CVE-2026-45989 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in testdrv_probe() The function testdrv_probe() retrieve… |
CVE-2026-45984 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dib… |
CVE-2026-45980 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Stop job scheduling across aie2_release_resource() Running jobs on a hardw… |
CVE-2026-45972 | Critical | 9.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and… |
CVE-2026-45970 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_h… |
CVE-2026-45956 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_conne… |
CVE-2026-45951 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free of BTF object Refcounting in the check_pseudo_btf_id(… |
CVE-2026-45946 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix use-after-free in power_supply_changed() Using the `devm_` var… |
CVE-2026-45938 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() Using the `devm_`… |
CVE-2026-45936 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: goldfish: Fix use-after-free in power_supply_changed() Using the `devm_` v… |
CVE-2026-45929 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix possible use-after-free in ovpn_net_xmit When building the skb_list in ovpn_net… |
CVE-2026-45916 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: sbs-battery: Fix use-after-free in power_supply_changed() Using the `devm_… |
CVE-2026-45914 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit 6946c72… |
CVE-2026-45906 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: pf1550: Fix use-after-free in power_supply_changed() Using the `devm_` var… |
CVE-2026-45902 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: Fix use-after-free in power_supply_changed() Using the `devm_` va… |
CVE-2026-45885 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() Using the `dev… |
CVE-2026-45882 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() Using the `dev… |
CVE-2026-45879 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25980: Fix use-after-free in power_supply_changed() Using the `devm_` va… |
CVE-2026-45867 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: power: supply: act8945a: Fix use-after-free in power_supply_changed() Using the `devm_` v… |
CVE-2026-45866 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free b… |
CVE-2026-45861 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objec… |
CVE-2026-45837 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_co… |
CVE-2026-24200 | High | 7.0 | 2026-05-26 | NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-after-free for stack memory. A successful exploit… |
CVE-2026-24187 | High | 8.8 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead… |
CVE-2026-41401 | Medium | 6.5 | 2026-05-26 | libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freei… |
CVE-2026-43499 | High | 7.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used b… |
CVE-2026-43497 | High | 7.3 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses… |
CVE-2026-45251 | High | 7.8 | 2026-05-21 | A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold… |
CVE-2026-9126 | High | 8.8 | 2026-05-20 | Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-9120 | High | 8.8 | 2026-05-20 | Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium securi… |
CVE-2026-9118 | High | 8.8 | 2026-05-20 | Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… |
CVE-2026-9114 | High | 8.8 | 2026-05-20 | Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network t… |
CVE-2026-9112 | High | 8.8 | 2026-05-20 | Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-9111 | High | 8.8 | 2026-05-20 | Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromi… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-3593 | High | 7.4 | 2026-05-20 | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21… |
CVE-2026-33278 | Critical | 9.8 | 2026-05-20 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote cod… |
CVE-2026-8953 | Critical | 9.6 | 2026-05-19 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140… |
CVE-2026-8947 | High | 7.3 | 2026-05-19 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, a… |
CVE-2026-47310 | High | 7.8 | 2026-05-19 | Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d… |
CVE-2026-28733 | Medium | 6.5 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution. |
CVE-2026-8746 | Medium | 4.3 | 2026-05-17 | A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this issue is the function discover_handler in the library /lib/sbi/nghttp2-server.c of… |
CVE-2026-8696 | High | 7.5 | 2026-05-15 | radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denia… |
CVE-2026-8695 | High | 7.5 | 2026-05-15 | radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending… |
CVE-2025-48521 | | 2026-05-15 | Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially re… | |
CVE-2026-8587 | High | 8.8 | 2026-05-14 | Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execu… |
CVE-2026-8581 | High | 8.8 | 2026-05-14 | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-8580 | Critical | 9.6 | 2026-05-14 | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-8575 | High | 8.3 | 2026-05-14 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-8574 | High | 8.3 | 2026-05-14 | Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-8557 | High | 7.5 | 2026-05-14 | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privileg… |
CVE-2026-8555 | High | 8.8 | 2026-05-14 | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromiu… |
CVE-2026-8553 | Low | 3.1 | 2026-05-14 | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds m… |
CVE-2026-8551 | High | 8.8 | 2026-05-14 | Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execut… |
CVE-2026-8550 | Medium | 6.5 | 2026-05-14 | Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially… |
CVE-2026-8549 | High | 8.8 | 2026-05-14 | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-8544 | High | 8.8 | 2026-05-14 | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-8542 | High | 8.3 | 2026-05-14 | Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-8533 | High | 8.3 | 2026-05-14 | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-8530 | High | 8.3 | 2026-05-14 | Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially… |