CWE-416 · Use After Free (page 23)
Page 23 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23270 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo… |
CVE-2026-23248 | High | 7.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_… |
CVE-2026-4148 | High | 8.8 | 2026-03-17 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $grap… |
CVE-2026-4271 | Medium | 5.3 | 2026-03-17 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A… |
CVE-2026-32724 | Medium | 5.3 | 2026-03-16 | PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The is… |
CVE-2026-3979 | Medium | 5.3 | 2026-03-12 | A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes u… |
CVE-2026-3936 | High | 8.8 | 2026-03-11 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-3924 | High | 7.5 | 2026-03-11 | use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-3923 | High | 8.8 | 2026-03-11 | Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3922 | High | 8.8 | 2026-03-11 | Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3921 | High | 8.8 | 2026-03-11 | Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-3919 | High | 8.8 | 2026-03-11 | Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2026-3918 | High | 8.8 | 2026-03-11 | Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3917 | High | 8.8 | 2026-03-11 | Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3805 | High | 7.5 | 2026-03-11 | When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. |
CVE-2026-27278 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-27220 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0112 | High | 7.4 | 2026-03-10 | In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2026-26330 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with… |
CVE-2026-26311 | Medium | 5.9 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (… |
CVE-2026-27277 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27276 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-3847 | High | 8.8 | 2026-03-10 | Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-26134 | High | 7.8 | 2026-03-10 | Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-26132 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26107 | High | 7.8 | 2026-03-10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-25189 | High | 7.8 | 2026-03-10 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-25178 | High | 7.0 | 2026-03-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25171 | High | 7.0 | 2026-03-10 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2026-25170 | High | 7.0 | 2026-03-10 | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-25167 | High | 7.4 | 2026-03-10 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24292 | High | 7.8 | 2026-03-10 | Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2026-24289 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-24285 | High | 7.0 | 2026-03-10 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-23671 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized att… |
CVE-2026-23669 | High | 8.8 | 2026-03-10 | Use after free in RPC Runtime allows an authorized attacker to execute code over a network. |
CVE-2026-23667 | High | 7.0 | 2026-03-10 | Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally. |
CVE-2026-28688 | Medium | 4.0 | 2026-03-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free… |
CVE-2026-28687 | Medium | 5.3 | 2026-03-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free… |
CVE-2026-28799 | High | 7.5 | 2026-03-06 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's eve… |
CVE-2025-13350 | | 2026-03-05 | Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When… | |
CVE-2026-22040 | Medium | 5.3 | 2026-03-04 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes a… |
CVE-2026-23234 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue… |
CVE-2026-23231 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() pub… |
CVE-2026-0027 | Medium | 6.7 | 2026-03-02 | In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with Sys… |
CVE-2025-47386 | High | 7.8 | 2026-03-02 | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47381 | High | 7.8 | 2026-03-02 | Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47379 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
CVE-2025-47377 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
CVE-2025-47376 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
CVE-2025-47375 | High | 7.8 | 2026-03-02 | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
CVE-2026-20443 | Medium | 6.7 | 2026-03-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20442 | Medium | 4.4 | 2026-03-02 | In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sy… |
CVE-2026-20439 | Medium | 4.4 | 2026-03-02 | In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the Sys… |
CVE-2026-20437 | Medium | 4.4 | 2026-03-02 | In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System… |
CVE-2026-27950 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is in… |
CVE-2026-26986 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during… |
CVE-2026-25997 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory beca… |
CVE-2026-25959 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangePropert… |
CVE-2026-25955 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data`… |
CVE-2026-25954 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` p… |
CVE-2026-25953 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` beca… |
CVE-2026-25952 | Critical | 9.8 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer b… |
CVE-2026-2804 | Medium | 5.4 | 2026-02-24 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2799 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2798 | High | 8.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2797 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2795 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2789 | Critical | 9.8 | 2026-02-24 | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Th… |
CVE-2026-2787 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148… |
CVE-2026-2786 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2772 | Critical | 9.8 | 2026-02-24 | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and… |
CVE-2026-2770 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, an… |
CVE-2026-2769 | High | 8.8 | 2026-02-24 | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Th… |
CVE-2026-2767 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2766 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2765 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2764 | Critical | 9.8 | 2026-02-24 | JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8… |
CVE-2026-2763 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thu… |
CVE-2026-2758 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunde… |
CVE-2026-26983 | Medium | 5.3 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter cr… |
CVE-2026-25983 | Medium | 5.3 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script t… |
CVE-2026-2889 | Low | 3.3 | 2026-02-21 | A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation resul… |
CVE-2026-2408 | Medium | 4.7 | 2026-02-20 | Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension. |
CVE-2026-26203 | Medium | 6.5 | 2026-02-19 | PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 p… |
CVE-2026-2660 | Low | 3.3 | 2026-02-18 | A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The ma… |
CVE-2026-23227 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to… |
CVE-2026-23226 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks sy… |
CVE-2026-23224 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Cal… |
CVE-2026-23223 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to… |
CVE-2026-23221 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() func… |
CVE-2026-2656 | Low | 2.5 | 2026-02-18 | A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_in… |
CVE-2026-23216 | High | 7.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_co… |
CVE-2026-2655 | Low | 2.5 | 2026-02-18 | A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chai… |
CVE-2026-25087 | High | 7.0 | 2026-02-17 | Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IP… |
CVE-2026-23209 | High | 7.8 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to cr… |
CVE-2026-23207 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to… |