CWE-416 · Use After Free (page 9)
Page 9 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17652 | Critical | 9.6 | 2026-07-30 | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-17650 | High | 8.3 | 2026-07-30 | Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-58185 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2026-58164 | High | 7.5 | 2026-07-29 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: fro… |
CVE-2026-50738 | Medium | 5.3 | 2026-07-28 | A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed o… |
CVE-2026-54620 | | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while sti… | |
CVE-2026-54619 | | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the p… | |
CVE-2026-64783 | High | 8.8 | 2026-07-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS… |
CVE-2026-64751 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26… |
CVE-2026-64729 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26… |
CVE-2026-64718 | Medium | 5.5 | 2026-07-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPa… |
CVE-2026-64703 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An ap… |
CVE-2026-64700 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Se… |
CVE-2026-43822 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Se… |
CVE-2026-43814 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26… |
CVE-2026-43812 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Se… |
CVE-2026-43810 | Critical | 9.8 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m… |
CVE-2026-43799 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Se… |
CVE-2026-43778 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Se… |
CVE-2026-28928 | Critical | 9.8 | 2026-07-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26… |
CVE-2026-64453 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->c… |
CVE-2026-64452 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks u… |
CVE-2026-64439 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_a… |
CVE-2026-64438 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt han… |
CVE-2026-64437 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f… |
CVE-2026-64434 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() run… |
CVE-2026-64433 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete add_device_complete()… |
CVE-2026-64424 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll… |
CVE-2026-64423 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is… |
CVE-2026-64421 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in… |
CVE-2026-64406 | High | 8.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference bef… |
CVE-2026-64401 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witnes… |
CVE-2026-64397 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to i… |
CVE-2026-64396 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blockin… |
CVE-2026-64372 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc()… |
CVE-2026-64365 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provi… |
CVE-2026-64363 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key_up_timer in remove() appleir_remove() runs hid_hw_st… |
CVE-2026-64362 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lg_g15_data is allocat… |
CVE-2026-64352 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trie_lookup_elem() annotates its rc… |
CVE-2026-64348 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an eh… |
CVE-2026-64346 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadget_match_driver The udc structure acts as the… |
CVE-2026-64344 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutex_unlock() may access the mutex s… |
CVE-2026-64343 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutex_unlock() may access the mutex str… |
CVE-2026-64342 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on… |
CVE-2026-64341 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutex_unlock() may access the mutex… |
CVE-2026-64340 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex_unlock() may access the mu… |
CVE-2026-64329 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_… |
CVE-2026-64311 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rng_alg has sev… |
CVE-2026-64305 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list i… |
CVE-2026-64303 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_s… |
CVE-2026-64300 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages… |
CVE-2026-64266 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the… |
CVE-2026-64265 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() move… |
CVE-2026-64261 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_qu… |
CVE-2026-64259 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might… |
CVE-2026-64251 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() d… |
CVE-2026-64249 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in child_regions_with_firmware() Move of_node_put(child_… |
CVE-2026-64246 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() … |
CVE-2026-64245 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigne… |
CVE-2026-64239 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the… |
CVE-2026-64226 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_wor… |
CVE-2026-64221 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mod… |
CVE-2026-64216 | Critical | 9.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_re… |
CVE-2026-49743 | High | 7.8 | 2026-07-24 | Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel… |
CVE-2026-16806 | High | 8.8 | 2026-07-23 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16805 | High | 8.8 | 2026-07-23 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16804 | High | 8.3 | 2026-07-23 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-13071 | Medium | 6.5 | 2026-07-22 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScrip… |
CVE-2026-52863 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view na… |
CVE-2026-50046 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_que… |
CVE-2026-16424 | Critical | 9.6 | 2026-07-21 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-16423 | High | 8.8 | 2026-07-21 | Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially e… |
CVE-2026-59850 | Medium | 4.3 | 2026-07-21 | A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has alread… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16362 | High | 8.8 | 2026-07-21 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16356 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16353 | Critical | 9.8 | 2026-07-21 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16352 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16351 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thu… |
CVE-2026-60080 | High | 7.3 | 2026-07-21 | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory paylo… |
CVE-2026-63729 | Medium | 6.6 | 2026-07-21 | The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerabil… |
CVE-2026-15905 | High | 7.8 | 2026-07-20 | Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium… |
CVE-2026-15904 | High | 8.8 | 2026-07-20 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-15902 | High | 8.8 | 2026-07-20 | Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-15901 | Critical | 9.6 | 2026-07-20 | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-15900 | Critical | 9.6 | 2026-07-20 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-15899 | Critical | 9.6 | 2026-07-20 | Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-64188 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() remo… |
CVE-2026-64178 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding th… |
CVE-2026-64142 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger()… |
CVE-2026-64132 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_io… |
CVE-2026-64123 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status gen… |
CVE-2026-64122 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_time… |
CVE-2026-64117 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx(… |
CVE-2026-64115 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_conn… |
CVE-2026-64113 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prune… |
CVE-2026-64109 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() doe… |
CVE-2026-64103 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is init… |
CVE-2026-64099 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fai… |
CVE-2026-64096 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig()… |