CWE-416 · Use After Free (page 2)
Page 2 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102760 | | 2026-09-29 | When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP laye… | |
CVE-2026-84783 | High | 7.5 | 2026-09-29 | Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread i… |
CVE-2026-76875 | Medium | 5.3 | 2026-09-29 | PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attack… |
CVE-2026-100832 | High | 8.8 | 2026-09-29 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.4… |
CVE-2026-100831 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Fir… |
CVE-2026-100825 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100818 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thun… |
CVE-2026-100815 | High | 8.8 | 2026-09-29 | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox… |
CVE-2026-100811 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… |
CVE-2026-100805 | High | 7.5 | 2026-09-29 | Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100804 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100800 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 1… |
CVE-2026-100797 | High | 8.8 | 2026-09-29 | Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbir… |
CVE-2026-100796 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100791 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fi… |
CVE-2026-100790 | High | 8.8 | 2026-09-29 | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, F… |
CVE-2026-100789 | High | 8.8 | 2026-09-29 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… |
CVE-2026-100786 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunder… |
CVE-2026-100785 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fi… |
CVE-2026-100784 | High | 8.8 | 2026-09-29 | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153… |
CVE-2026-100780 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fi… |
CVE-2026-100779 | High | 8.8 | 2026-09-29 | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, F… |
CVE-2026-100778 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… |
CVE-2026-100777 | High | 8.8 | 2026-09-29 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… |
CVE-2026-100776 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 15… |
CVE-2026-100774 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fi… |
CVE-2026-100773 | High | 8.8 | 2026-09-29 | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… |
CVE-2026-100772 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fi… |
CVE-2026-100770 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 1… |
CVE-2026-100769 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 15… |
CVE-2026-100768 | High | 8.8 | 2026-09-29 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100767 | High | 8.8 | 2026-09-29 | Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, F… |
CVE-2026-100765 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100762 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 1… |
CVE-2026-100761 | High | 8.8 | 2026-09-29 | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100757 | High | 8.8 | 2026-09-29 | Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157… |
CVE-2026-95391 | Medium | 5.5 | 2026-09-29 | ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service |
CVE-2026-91096 | High | 7.5 | 2026-09-28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) f… |
CVE-2026-91095 | Medium | 5.3 | 2026-09-28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could ret… |
CVE-2026-84895 | High | 7.3 | 2026-09-28 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSes… |
CVE-2026-84894 | High | 7.5 | 2026-09-28 | In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under… |
CVE-2026-15442 | Medium | 5.3 | 2026-09-27 | In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use… |
CVE-2026-98163 | High | 7.0 | 2026-09-26 | In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgro… |
CVE-2026-100503 | Low | 3.3 | 2026-09-26 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect… |
CVE-2026-95834 | | 2026-09-25 | Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the t… | |
CVE-2026-97222 | Medium | 5.5 | 2026-09-25 | A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML pa… |
CVE-2026-93834 | High | 8.8 | 2026-09-25 | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcr… |
CVE-2026-100077 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire t… |
CVE-2026-98083 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID st… |
CVE-2026-6928 | Critical | 9.8 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may… |
CVE-2026-96889 | High | 7.8 | 2026-09-23 | A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free… |
CVE-2026-91818 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation en… |
CVE-2026-91816 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript… |
CVE-2026-91809 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may c… |
CVE-2026-91806 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the… |
CVE-2026-91805 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during re… |
CVE-2026-91799 | High | 7.8 | 2026-09-23 | A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to a… |
CVE-2026-91793 | High | 7.8 | 2026-09-23 | When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. Duri… |
CVE-2026-91792 | High | 7.8 | 2026-09-23 | When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScri… |
CVE-2026-91791 | High | 7.8 | 2026-09-23 | When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visi… |
CVE-2026-91790 | High | 7.8 | 2026-09-23 | When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a resul… |
CVE-2026-8849 | | 2026-09-22 | Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 befor… | |
CVE-2026-74766 | High | 8.4 | 2026-09-22 | Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_… |
CVE-2026-73513 | High | 7.5 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 u… |
CVE-2026-73512 | High | 7.5 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandle… |
CVE-2026-50572 | Medium | 5.9 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-auth… |
CVE-2026-94084 | Critical | 9.4 | 2026-09-20 | Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a trans… |
CVE-2026-94055 | Low | 3.7 | 2026-09-19 | Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. |
CVE-2026-88097 | High | 8.1 | 2026-09-18 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-93586 | Low | 2.9 | 2026-09-18 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated co… |
CVE-2026-93382 | High | 8.8 | 2026-09-17 | Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-93374 | Critical | 9.6 | 2026-09-17 | Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
CVE-2026-93373 | Critical | 9.6 | 2026-09-17 | Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chro… |
CVE-2026-92474 | Low | 3.3 | 2026-09-16 | A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the compo… |
CVE-2026-92473 | Low | 3.3 | 2026-09-16 | A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of the file src/scenegraph/commands.c of the component… |
CVE-2026-92472 | Low | 3.3 | 2026-09-16 | A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of th… |
CVE-2026-92627 | | 2026-09-16 | A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-p… | |
CVE-2026-19666 | High | 7.5 | 2026-09-16 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process w… |
CVE-2026-19662 | Medium | 5.9 | 2026-09-16 | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zon… |
CVE-2026-82720 | Medium | 5.9 | 2026-09-16 | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. Duri… |
CVE-2026-78227 | Medium | 6.5 | 2026-09-16 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each… |
CVE-2026-85893 | High | 8.8 | 2026-09-15 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-91749 | Critical | 9.6 | 2026-09-15 | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cra… |
CVE-2026-91747 | Low | 3.1 | 2026-09-15 | Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data v… |
CVE-2026-91745 | High | 8.8 | 2026-09-15 | Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-91737 | High | 8.8 | 2026-09-15 | Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-91736 | High | 8.8 | 2026-09-15 | Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-91729 | Critical | 9.6 | 2026-09-15 | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
CVE-2026-91724 | High | 8.3 | 2026-09-15 | Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbit… |
CVE-2026-91722 | High | 8.8 | 2026-09-15 | Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
CVE-2026-91721 | High | 8.8 | 2026-09-15 | Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a c… |
CVE-2026-91718 | Critical | 9.6 | 2026-09-15 | Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91716 | Critical | 9.6 | 2026-09-15 | Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91710 | Critical | 9.6 | 2026-09-15 | Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… |
CVE-2026-58751 | Medium | 6.7 | 2026-09-15 | In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege w… |
CVE-2026-58724 | High | 7.0 | 2026-09-15 | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privi… |
CVE-2026-56988 | Medium | 6.4 | 2026-09-15 | In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with Sy… |
CVE-2026-56964 | Medium | 6.4 | 2026-09-15 | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privi… |
CVE-2026-56960 | Critical | 9.8 | 2026-09-15 | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additiona… |
CVE-2026-56914 | High | 8.4 | 2026-09-15 | In multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional executio… |