By weakness (CWE)

CWE-415: related vulnerabilities

CVEs classified under CWE-415. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

26 published vulnerabilities

• CVE-2026-12043HIGH 8.8

  AWS Common Runtime's HTTP/2 library contains a flaw in how it processes dynamic table size updates from remote servers. An attacker operating a malicious server could send a carefully crafted sequence of HTTP/2 frames to corrupt memory in client applications that connect to it, potentially allowing arbitrary code execution. This affects any application using the aws-c-http library for HTTP/2 communication.

• CVE-2026-53322HIGH 8.8

  A timing vulnerability in the Linux kernel's VFIO (Virtual Function I/O) PCI driver creates a brief but exploitable window during device shutdown. When a PCIe function is disabled, the driver must revoke all direct memory access (DMABUF) mappings before clearing the Memory Space Enable (MSE) bit. If MSE is disabled first, a narrow race condition allows unprivileged local users to continue accessing device memory through existing DMABUF mappings even after the function should be inaccessible. This could lead to unauthorized data access, modification, or denial of service on systems where VFIO and DMABUFs are in active use.

• CVE-2026-46129HIGH 7.8

  A double-free memory corruption bug exists in the Linux kernel's Btrfs filesystem implementation. When the kernel initializes and registers filesystem space information objects with the sysfs interface, a failure in that registration process can cause the same memory block to be freed twice. This happens because the error recovery code doesn't account for cleanup already performed by the object release callback. A local attacker with unprivileged user access could trigger this condition and gain kernel-level privileges.

• CVE-2026-46162HIGH 7.8

  A flaw in the Linux kernel's ice (Intel ice) network driver creates a double-free memory corruption condition in the auxiliary device activation error handler. When the driver attempts to activate a subfunction Ethernet device but the operation fails partway through, the error handling code frees the same memory region twice, corrupting the kernel heap. An attacker with local access and unprivileged user privileges can trigger this condition to escalate privileges or crash the system.

• CVE-2026-46183HIGH 7.8

  A race condition exists in the Linux kernel's DAMON (Data Access Monitoring) subsystem where multiple processes can simultaneously read and write to a shared memory path variable without proper synchronization. When one process deallocates this buffer while another is reading it, the reader accesses freed memory—a use-after-free condition. The vulnerability requires local system access and standard user privileges to exploit, but grants attackers the ability to read sensitive kernel memory, corrupt data structures, or crash the system. This is a classic synchronization flaw that occurs when direct user-driven file operations bypass the locking mechanisms protecting background parameter-commit operations.

• CVE-2026-46189HIGH 7.8

  A flaw in the Linux kernel's RDMA (Remote Direct Memory Access) vmw_pvrdma driver causes the same memory block to be freed twice when certain error conditions occur during user context allocation. When the pvrdma_alloc_ucontext() function encounters an error, it attempts to clean up by calling pvrdma_uar_free(). However, the normal cleanup path (pvrdma_dealloc_ucontext()) also calls this same free function, resulting in a double-free scenario. This type of memory corruption can lead to kernel crashes or potentially be exploited for privilege escalation on systems with unprivileged user access to RDMA devices.

• CVE-2026-46279HIGH 7.8

  CVE-2026-46279 is a memory management bug in the Linux kernel where pages allocated very early in the boot process—before the page tracking system is fully ready—end up without proper metadata. When these pages are later freed by KASAN (a memory safety tool), the kernel throws a warning because it can't find the tracking information. While this is primarily a diagnostic issue triggered under specific debugging configurations, it indicates a real ordering problem during kernel initialization that needs correction to maintain system stability and prevent potential memory tracking corruption.

• CVE-2026-53009HIGH 7.8

  A memory management bug exists in the Linux kernel's Intel ice network driver. When packet transmission setup fails, the driver frees a network buffer (skb) but leaves a reference to it marked as still valid. If the network interface is then shut down without sending another packet, the driver attempts to free the same buffer twice, causing a crash or memory corruption. This is a local privilege escalation vulnerability affecting systems running vulnerable Linux kernels with the ice driver.

• CVE-2026-53067HIGH 7.8

  A memory management flaw in the Linux kernel's PCI endpoint MSI (Message Signaled Interrupt) module can allow a local attacker with low privileges to cause a denial of service or potentially gain elevated access. The vulnerability occurs during doorbell allocation when MSI vector requests fail—the kernel fails to properly clean up allocated memory, leaving stale pointers that can be dereferenced later or reallocated, leading to exploitable conditions. The issue also allows an attacker to repeatedly attempt allocation of the same resource without proper gating, potentially triggering the flaw multiple times.

• CVE-2026-53233HIGH 7.8

  A double-free memory corruption flaw exists in the Linux kernel's network device management layer. When the kernel attempts to send a reply message via the generic netlink interface in netdev_nl_bind_rx_doit(), a code path error can cause the same memory buffer to be freed twice—once by the messaging function and again by the error handler. This occurs only under specific conditions (such as when a user's receive buffer is already full), but when triggered, it corrupts kernel memory and can lead to privilege escalation or system crash.

• CVE-2026-53286HIGH 7.8

  CVE-2026-53286 is a double-free and use-after-free vulnerability in the Linux kernel's IDPF (Intel Data Plane Development Kit) driver. When the driver attempts to initialize certain auxiliary devices and encounters errors during the add operation, it frees memory incorrectly, leading to potential double-frees and accessing memory after it has been freed. An unprivileged local user could exploit this to crash the kernel or potentially achieve higher privileges.

• CVE-2026-53294HIGH 7.8

  A memory management flaw exists in the Linux kernel's mailbox test module where a communication channel can be freed twice when it's reused across different operations. This happens because the code fails to recognize when the receive channel is actually an alias—a reference to the same underlying channel—rather than a separate resource. When cleanup occurs, the system attempts to free the same memory region twice, causing a crash or potential instability.

• CVE-2026-11576HIGH 7.5

  A recent security patch for eclipse-threadx NetX Duo's HTTP server introduced a new vulnerability. When handling file upload requests, the code uses a single cleanup routine that always tries to close a file—even if the file was never opened in the first place. If an error occurs before the file is successfully opened, the cleanup code attempts to close an uninitialized file handle, causing the application to crash, leak memory, or potentially corrupt data. This is a regression: the patch meant to fix one vulnerability inadvertently created another.

• CVE-2026-14164HIGH 7.5

  CVE-2026-14164 is a memory corruption vulnerability in libarchive, a widely-used library for reading and writing archive formats. When processing a specially-crafted RAR5 archive file, the library can accidentally free the same memory location twice—a condition known as a double-free. This can cause applications that use libarchive to crash unexpectedly. The vulnerability requires no user authentication and can be triggered remotely by sending a malicious archive file, but it does not enable data theft or system compromise—only denial of service through application termination.

• CVE-2026-44422HIGH 7.5

  FreeRDP, a widely-used open-source Remote Desktop Protocol client, contains a memory corruption vulnerability in its authentication-redirection subsystem. A malicious RDP server can craft specially-formed authentication data that causes the FreeRDP client to allocate a single heap object but then attempt to free it twice—or use it after the first deallocation. This occurs because the parser doesn't properly track which heap objects correspond to which data structures when the same object reference is reused. The result is a crash or potential code execution on the client machine. The vulnerability requires user interaction (connecting to a malicious server) but affects all FreeRDP versions before 3.26.0.

• CVE-2026-46164HIGH 7.0

  A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.

• CVE-2026-56109MEDIUM 6.8

  CVE-2026-56109 is a memory corruption vulnerability in ALSA (Advanced Linux Sound Architecture), a fundamental audio library used across Linux systems. When the library parses a specially crafted audio configuration file, it accidentally frees the same memory location twice—a condition called a double-free. This memory corruption can crash audio services or potentially allow an attacker to corrupt data on the system. The vulnerability requires local access and a malicious configuration file, so it poses a moderate but real risk to Linux deployments where untrusted users can provide audio configuration.

• CVE-2026-43706MEDIUM 6.5

  Apple released security updates to fix a double free memory vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw could crash applications when users interact with specially crafted web content, but does not enable data theft or system compromise. This is a medium-severity availability issue requiring user interaction to trigger.

• CVE-2026-10653MEDIUM 6.4

  Zephyr's network buffer library has a race condition in how it tracks when buffers are no longer in use. The library uses reference counts to know when a buffer can be safely freed, but these counts are updated using regular (non-atomic) operations. When multiple threads or tasks share the same buffer and call the unref function simultaneously, a timing race can cause the library to think two different holders are the last user—leading to the same buffer being freed twice, memory corruption, and potential use-after-free conditions. The vulnerability affects multiple subsystems including networking, Bluetooth, USB, and message passing. Actual exploitation requires genuine concurrency, shared buffer architecture in the application, and precise timing; external attackers have limited ability to trigger it directly.

• CVE-2026-14604MEDIUM 6.3

  Assimp, an open-source 3D model import/export library widely used in game engines, graphics applications, and CAD tools, contains a memory management flaw in its PLY (Polygon File Format) handler. When exporting 3D models to the PLY format, the library can inadvertently free the same memory region twice—a condition known as a double-free error. An authenticated attacker can trigger this flaw remotely by submitting a specially crafted PLY file, leading to application crash or potential code execution. The vulnerability affects Assimp versions up to and including 6.0.4.

• CVE-2026-58381MEDIUM 6.1

  GIMP, a widely used open-source image editor, contains a memory safety bug in its PSP (PaintShop Pro) file parser. When GIMP opens a specially crafted PSP file, a programming error causes the application to attempt to free the same memory block twice—a condition known as a double-free. This can corrupt the application's memory state, crash the program, or in some cases allow an attacker to execute arbitrary code on the system. The vulnerability requires local file access and user interaction (opening the malicious file), limiting but not eliminating real-world risk.

• CVE-2026-46690MEDIUM 5.8

  A memory safety vulnerability exists in unbounded_spsc versions 0.2.0 and earlier, a Rust library for lock-free message passing. The flaw occurs when the sender transmutes a pointer as a value and then sends it, which can cause the receiver to read memory outside the intended bounds or incorrectly drop a reference-counted object if the sender and receiver operate concurrently. This could lead to information disclosure or denial of service. No public patches are currently available.

• CVE-2026-35188MEDIUM 5.0

  A flaw in OpenSSL's handling of TLS OCSP stapling—an optimization that allows servers to provide certificate validity proof directly—can cause a double-free memory error in connecting clients. When a malicious server sends a specially crafted OCSP response, it triggers corruption of the client's heap memory. While OCSP stapling is disabled by default, organizations that have explicitly enabled it face exposure. The vulnerability reliably causes denial of service; remote code execution is theoretically possible but difficult to reliably achieve in practice.

• CVE-2026-55653MEDIUM 4.3

  A vulnerability exists in OpenSSH where a malicious SSH server can trigger a double-free memory error in the client during Diffie-Hellman Group Exchange (DH-GEX) parameter validation in FIPS mode. When an SSH client connects to a compromised or attacker-controlled server, the server can send specially crafted DH-GEX parameters that cause the client process to crash, resulting in a denial of service. This affects users and automated systems that initiate SSH connections to untrusted or compromised servers.

• CVE-2025-15667LOW 3.3

  GPAC, a popular multimedia framework used for MP4 file processing, contains a double-free memory vulnerability in its MP4Box component. The flaw exists in the `gf_isom_nalu_sample_rewrite` function and can be triggered by manipulating a specific argument (`nalu_out_bs`). An attacker with local access can craft a malicious MP4 file that, when processed by GPAC, causes the application to free the same memory region twice, potentially crashing the process. The vulnerability has been publicly disclosed, and a patch is available.

• CVE-2026-45324LOW 3.3

  Rizin, a reverse engineering framework used for binary analysis and code inspection, contains a double free vulnerability in its search functionality. This occurs when the same memory location is freed twice, potentially causing application crashes or unexpected behavior. The vulnerability requires physical access to the system and user interaction to trigger, making it a lower-risk issue in most operational environments.