CWE-416 · Use After Free (page 3)
Page 3 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64246 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() … |
CVE-2026-64245 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigne… |
CVE-2026-64239 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the… |
CVE-2026-64226 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_wor… |
CVE-2026-64221 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mod… |
CVE-2026-64216 | Critical | 9.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_re… |
CVE-2026-49743 | High | 7.8 | 2026-07-24 | Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel… |
CVE-2026-16806 | High | 8.8 | 2026-07-23 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16805 | High | 8.8 | 2026-07-23 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16804 | High | 8.3 | 2026-07-23 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-13071 | Medium | 6.5 | 2026-07-22 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScrip… |
CVE-2026-52863 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view na… |
CVE-2026-50046 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_que… |
CVE-2026-16424 | Critical | 9.6 | 2026-07-21 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-16423 | High | 8.8 | 2026-07-21 | Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially e… |
CVE-2026-59850 | Medium | 4.3 | 2026-07-21 | A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has alread… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16362 | High | 8.8 | 2026-07-21 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16356 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16353 | Critical | 9.8 | 2026-07-21 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16352 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16351 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thu… |
CVE-2026-60080 | High | 7.3 | 2026-07-21 | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory paylo… |
CVE-2026-63729 | Medium | 6.6 | 2026-07-21 | The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerabil… |
CVE-2026-15905 | High | 7.8 | 2026-07-20 | Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium… |
CVE-2026-15904 | High | 8.8 | 2026-07-20 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-15902 | High | 8.8 | 2026-07-20 | Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-15901 | Critical | 9.6 | 2026-07-20 | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-15900 | Critical | 9.6 | 2026-07-20 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-15899 | Critical | 9.6 | 2026-07-20 | Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-64188 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() remo… |
CVE-2026-64178 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding th… |
CVE-2026-64142 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger()… |
CVE-2026-64132 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_io… |
CVE-2026-64123 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status gen… |
CVE-2026-64122 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_time… |
CVE-2026-64115 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_conn… |
CVE-2026-64113 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prune… |
CVE-2026-64109 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() doe… |
CVE-2026-64103 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is init… |
CVE-2026-64099 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fai… |
CVE-2026-64096 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig()… |
CVE-2026-63804 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback… |
CVE-2026-63803 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/… |
CVE-2026-63802 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are re… |
CVE-2026-63801 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes str… |
CVE-2026-63800 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branc… |
CVE-2026-63797 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly… |
CVE-2026-63795 | Critical | 10.0 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called w… |
CVE-2026-63793 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol->volume_label with a mutex and snaphost… |
CVE-2026-53401 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with O… |
CVE-2026-53389 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_a… |
CVE-2026-53388 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the… |
CVE-2026-53384 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() reg… |
CVE-2026-53381 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if th… |
CVE-2026-58598 | High | 7.0 | 2026-07-16 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate p… |
CVE-2026-57076 | High | 7.8 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled… |
CVE-2026-13713 | Medium | 6.2 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled… |
CVE-2026-55406 | | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allow… | |
CVE-2026-6424 | | 2026-07-16 | Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system | |
CVE-2026-38753 | Medium | 4.9 | 2026-07-15 | A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK s… |
CVE-2026-56434 | Medium | 6.5 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), prox… |
CVE-2026-61860 | Low | 3.7 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and… |
CVE-2026-15777 | High | 7.5 | 2026-07-14 | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to pote… |
CVE-2026-15774 | High | 8.3 | 2026-07-14 | Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-15773 | Critical | 9.6 | 2026-07-14 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-15772 | High | 8.3 | 2026-07-14 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-15765 | High | 7.5 | 2026-07-14 | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-15764 | High | 7.5 | 2026-07-14 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-58637 | High | 7.0 | 2026-07-14 | Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-58634 | High | 7.8 | 2026-07-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-58633 | High | 7.8 | 2026-07-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-58632 | High | 7.8 | 2026-07-14 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-58629 | High | 7.0 | 2026-07-14 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2026-58626 | High | 8.8 | 2026-07-14 | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. |
CVE-2026-58619 | High | 7.0 | 2026-07-14 | Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-58613 | High | 7.8 | 2026-07-14 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-58544 | High | 7.0 | 2026-07-14 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-58543 | Medium | 6.3 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-58537 | High | 7.8 | 2026-07-14 | Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally. |
CVE-2026-58536 | High | 7.8 | 2026-07-14 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-58531 | High | 7.5 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges… |
CVE-2026-57093 | High | 7.0 | 2026-07-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-57092 | Critical | 9.9 | 2026-07-14 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. |
CVE-2026-57089 | High | 7.5 | 2026-07-14 | Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network. |
CVE-2026-56649 | Medium | 5.9 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to e… |
CVE-2026-56648 | High | 7.5 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56644 | High | 7.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-56643 | High | 7.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-56187 | High | 7.0 | 2026-07-14 | Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-56183 | High | 7.0 | 2026-07-14 | Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-56173 | High | 7.0 | 2026-07-14 | Use after free in Windows WebView allows an authorized attacker to elevate privileges locally. |
CVE-2026-55128 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-55032 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-55018 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-54131 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-54128 | High | 8.4 | 2026-07-14 | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally. |
CVE-2026-54125 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privile… |
CVE-2026-50689 | High | 7.8 | 2026-07-14 | Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50688 | High | 7.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |