CWE-416 · Use After Free (page 7)
Page 7 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53234 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_regist… |
CVE-2026-53212 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() call… |
CVE-2026-53198 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-r… |
CVE-2026-53193 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via… |
CVE-2026-53192 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a… |
CVE-2026-53185 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or… |
CVE-2026-53175 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, f… |
CVE-2026-53161 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race be… |
CVE-2026-53160 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a… |
CVE-2026-53157 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a… |
CVE-2026-53156 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths… |
CVE-2026-12245 | High | 7.5 | 2026-06-25 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivi… |
CVE-2026-57589 | High | 7.4 | 2026-06-25 | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsle… |
CVE-2025-60466 | Medium | 5.0 | 2026-06-25 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60467 | High | 7.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2026-13038 | High | 8.8 | 2026-06-24 | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-13037 | High | 7.8 | 2026-06-24 | Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13036 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13035 | High | 8.8 | 2026-06-24 | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Ch… |
CVE-2026-13032 | Critical | 9.6 | 2026-06-24 | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-13031 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13029 | High | 7.5 | 2026-06-24 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to pote… |
CVE-2026-13028 | Critical | 9.6 | 2026-06-24 | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-13027 | High | 8.8 | 2026-06-24 | Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-13026 | High | 8.8 | 2026-06-24 | Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a cr… |
CVE-2025-60471 | Medium | 5.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to c… |
CVE-2026-53129 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrin… |
CVE-2026-53120 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probed through __driver_… |
CVE-2026-53119 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driver is probed through… |
CVE-2026-53118 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_override infrastructure When a driver is probed through __driver… |
CVE-2026-53117 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is probed through __dr… |
CVE-2026-53116 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks are updated via apm… |
CVE-2026-53115 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through _… |
CVE-2026-53112 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_taskl… |
CVE-2026-53109 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcoun… |
CVE-2026-53098 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci… |
CVE-2026-53097 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci… |
CVE-2026-53089 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offload… |
CVE-2026-53085 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator re… |
CVE-2026-53071 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp(… |
CVE-2026-53055 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission… |
CVE-2026-53046 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message… |
CVE-2026-53040 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an ou… |
CVE-2026-53033 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sock… |
CVE-2026-53025 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a… |
CVE-2026-53024 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to… |
CVE-2026-53011 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sc… |
CVE-2026-53010 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to… |
CVE-2026-53009 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in … |
CVE-2026-53006 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is prob… |
CVE-2026-53005 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX G… |
CVE-2026-52982 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN sla… |
CVE-2026-52976 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist… |
CVE-2026-52973 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_… |
CVE-2026-52971 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check a… |
CVE-2026-52951 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when… |
CVE-2026-52950 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed o… |
CVE-2026-52947 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_rem… |
CVE-2026-52943 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_heade… |
CVE-2026-52924 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked w… |
CVE-2026-52912 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->d… |
CVE-2026-56117 | Medium | 4.7 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows lo… |
CVE-2026-56113 | Medium | 5.3 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemo… |
CVE-2026-56376 | Low | 3.7 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale p… |
CVE-2026-6653 | Critical | 9.8 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via malici… |
CVE-2026-56412 | Medium | 4.9 | 2026-06-21 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers… |
CVE-2026-12706 | Medium | 6.5 | 2026-06-19 | A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but… |
CVE-2026-11941 | Medium | 5.6 | 2026-06-19 | Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “qu… |
CVE-2026-41156 | High | 7.7 | 2026-06-19 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free s… |
CVE-2026-34192 | High | 7.7 | 2026-06-19 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vuln… |
CVE-2026-56131 | Medium | 4.9 | 2026-06-19 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-fr… |
CVE-2026-11791 | Medium | 5.0 | 2026-06-18 | A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, by… |
CVE-2026-9158 | Critical | 9.8 | 2026-06-18 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This… |
CVE-2026-42530 | High | 8.1 | 2026-06-17 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenti… |
CVE-2026-12467 | High | 8.3 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12464 | High | 8.3 | 2026-06-17 | Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-12462 | High | 7.5 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code i… |
CVE-2026-12455 | High | 7.5 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potent… |
CVE-2026-12452 | High | 8.8 | 2026-06-17 | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-12451 | High | 8.3 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12449 | High | 7.8 | 2026-06-17 | Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malici… |
CVE-2026-12445 | High | 7.5 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-12443 | High | 8.8 | 2026-06-17 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-12442 | High | 8.8 | 2026-06-17 | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-12441 | High | 8.8 | 2026-06-17 | Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12440 | Critical | 9.6 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-12439 | High | 8.8 | 2026-06-17 | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12437 | High | 8.3 | 2026-06-17 | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-0143 | High | 7.8 | 2026-06-16 | In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi… |
CVE-2026-0137 | High | 7.8 | 2026-06-16 | In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escala… |
CVE-2026-0125 | High | 7.0 | 2026-06-16 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addi… |
CVE-2026-10640 | Medium | 4.2 | 2026-06-16 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-s… |
CVE-2026-10639 | Medium | 4.8 | 2026-06-16 | In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and… |
CVE-2026-10638 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and… |
CVE-2026-10637 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ow… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |