By weakness (CWE)

CWE-416: related vulnerabilities

CVEs classified under CWE-416. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

426 published vulnerabilities · page 5 of 5

• CVE-2025-60471MEDIUM 5.5

  GPAC Project's MP4Box, a widely-used multimedia processing tool, contains a use-after-free memory flaw in its filter configuration logic. When processing a specially crafted media file, the vulnerable code attempts to access memory that has already been freed, causing the application to crash. An attacker can exploit this by distributing a malicious media file that, when opened by a user, brings down MP4Box. This is a denial-of-service vulnerability—it doesn't steal data or grant unauthorized access, but it can disrupt workflows that depend on MP4Box for media processing.

• CVE-2025-60486MEDIUM 5.5

  A memory safety flaw in GPAC's MP4Box tool allows an attacker to crash the application by processing a specially crafted MPEG-2 video file. The vulnerability stems from improper memory management in the dasher_process function—specifically, the code attempts to access memory that has already been freed. An attacker with local file access can exploit this by distributing a malicious video file that, when opened in MP4Box, triggers the defect and renders the tool unusable. This is a denial-of-service issue rather than a path to code execution or data theft.

• CVE-2026-44805MEDIUM 5.5

  A use-after-free vulnerability exists in Windows Network Controller Host Agent that allows a logged-in user to crash or hang the affected service, disrupting network configuration and management capabilities. The attacker must already have local user privileges on the system to exploit this flaw. While this is not currently known to be exploited in the wild, it represents a local denial-of-service risk that can render critical network infrastructure management unavailable.

• CVE-2026-47924MEDIUM 5.5

  Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a use-after-free memory flaw that could allow an attacker to read sensitive data from the application's memory. The vulnerability requires a user to open a crafted malicious PDF or document file, making this a low-friction attack that relies on social engineering rather than complex exploitation techniques. While memory disclosure alone does not enable direct system compromise, the leaked information could include credentials, encryption keys, or other confidential content.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-12298MEDIUM 5.4

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that allows an attacker to read or modify memory during user interaction with a malicious website or email. The flaw does not enable remote code execution or denial of service, but could leak sensitive information or corrupt application state. Mozilla has released patched versions to address this issue.

• CVE-2026-10232MEDIUM 5.3

  CVE-2026-10232 is a use-after-free vulnerability in Assimp, an open-source 3D model import library, affecting versions up to 6.0.4. The flaw exists in the ASE file parser component and can be triggered by a local attacker with user-level privileges when processing specially crafted ASE (ASCII Scene Export) files. Exploitation could allow an attacker to read sensitive data, modify application state, or crash the process. Because exploitation requires local access and user permissions, the risk is primarily relevant in multi-user systems or scenarios where untrusted ASE files are processed by privileged applications.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12329MEDIUM 5.3

  A memory safety defect affecting Mozilla Firefox and Thunderbird could allow an unauthenticated attacker to cause the application to crash or become unavailable. The vulnerability requires no user interaction and can be triggered remotely over a network. It does not enable data theft or system compromise, but denial-of-service impact is possible.

• CVE-2026-56113MEDIUM 5.3

  dhcpcd, a widely-used DHCP client daemon, contains a memory safety bug that can be triggered by a malicious DHCPv6 server on the same network. An attacker who can send a specially crafted DHCPv6 renewal message can cause dhcpcd to crash. The vulnerability exists in how dhcpcd manages IPv6 address delegation—specifically when an attacker sets both lifetime values to zero in a prefix delegation exclusion option. Versions through 10.3.2 are affected; the fix is available in commit 5733d3c and later releases.

• CVE-2026-57436MEDIUM 5.3

  Nokogiri, a popular Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety bug in versions prior to 1.19.4. The vulnerability allows an attacker to set an invalid type of object (specifically a DTD node) as a document's root element, bypassing validation checks. This causes the library to crash or behave unpredictably when the invalid structure is processed during garbage collection. The issue is resolved in version 1.19.4 and later.

• CVE-2026-57437MEDIUM 5.3

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a memory safety issue in its XPath evaluation feature. If application code manually creates an XPathContext object and then allows the underlying XML/HTML document to be garbage collected while the context is still in use, subsequent XPath queries can read from freed memory, potentially crashing the application. This is a narrow vulnerability—it requires specific patterns in application code and cannot be triggered by feeding a malicious document to the library. The standard document search methods (Document#xpath, Document#css) are not affected.

• CVE-2025-60466MEDIUM 5.0

  GPAC MP4Box versions before 26.02.0 contain a memory safety flaw where freed memory can be accessed during packet filtering operations. An attacker who supplies a specially crafted media file can trigger a crash or service interruption. The vulnerability requires local access and user interaction (opening the file), limiting its direct remote exploitation potential but posing a risk in automated or batch processing environments.

• CVE-2026-11791MEDIUM 5.0

  A memory safety defect in 389 Directory Server can crash the service when an administrator reloads the schema while the server is handling active LDAP queries. The vulnerability stems from improper cleanup of attribute syntax data structures during schema reload, allowing worker threads to access memory that has already been freed. This condition results in a denial of service but does not enable data theft or modification.

• CVE-2026-50219MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when certain XML parsing functions (XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset) are called from within event handlers without proper depth tracking. This can lead to memory safety violations and potentially allow attackers to crash applications or, in some scenarios, execute arbitrary code. The vulnerability requires local access and specific conditions to trigger, making it a moderate-risk issue rather than a widespread internet-facing threat.

• CVE-2026-56131MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when the XML_ResumeParser function is called from within a handler and a policy violation is detected. In such cases, the library fails to properly track the call stack depth, leaving freed memory accessible and potentially exploitable. This is analogous to an earlier vulnerability (CVE-2026-50219) in the same codebase.

• CVE-2026-56412MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in its CDATA section handling. The issue stems from incomplete depth tracking when handlers are invoked during XML processing, allowing memory already freed by one operation to be accessed by another. This affects versions before 2.8.2. While the immediate trigger requires specific XML policy violations and local system access, the underlying condition can lead to crashes or potentially arbitrary code execution if an attacker controls the malicious XML input.

• CVE-2026-10634MEDIUM 4.8

  A race condition in Zephyr's TCP stack allows an attacker on the local network to crash the system or potentially read sensitive memory. The vulnerability exists in how the TCP layer iterates through active connections while a background thread can simultaneously free those connections, causing the iterator to access memory that has already been released. While the attacker needs local network access and user privileges to trigger the issue reliably, the outcome is denial of service or information disclosure on affected embedded and IoT devices running Zephyr.

• CVE-2026-10639MEDIUM 4.8

  Zephyr's IPv4 networking stack contains a use-after-free vulnerability in how it handles ping (ICMP echo) responses. When the device sends back a reply to an incoming ping, it processes the packet through the transmission path, which may immediately free the packet's memory. The code then attempts to read data from that freed memory to update network statistics, creating a window for reading corrupted or recycled data. An attacker can trigger this by sending repeated pings to a Zephyr device, potentially causing statistics corruption or a crash. The vulnerability requires specific configuration options to be enabled and the timing must align with the kernel's memory recycling, making exploitation probabilistic but feasible over a network without authentication.

• CVE-2026-11249MEDIUM 4.7

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the Network component. If an attacker compromises Chrome's renderer process—the sandboxed part that runs web content—they could read sensitive data from the browser's memory using a specially crafted HTML page. This is a memory safety issue: the code attempts to access data after it has already been freed, potentially exposing unencrypted information that was in use moments before.

• CVE-2026-56117MEDIUM 4.7

  dhcpcd, a widely deployed DHCP client daemon, contains a memory safety bug that can crash the service when privilege separation is disabled. A local user on the same system can exploit this by sending a specially crafted command to dhcpcd's control socket, causing the daemon to reference memory it has already freed. While the vulnerability requires local access and a specific configuration, it represents a denial-of-service risk in environments where dhcpcd runs with privilege separation turned off—a configuration sometimes found in embedded systems or minimal deployments.

• CVE-2026-11623MEDIUM 4.5

  A use-after-free memory vulnerability exists in tmux versions up to 3.6a, specifically within the image handling code. An attacker with local system access could trigger this flaw through a complex exploitation chain to read, modify, or crash tmux processes. While a public exploit has been disclosed, the attack requires both local access and deliberate manipulation, making opportunistic exploitation unlikely. The issue is resolved by upgrading to version 3.7-rc or applying the specific patch commit fc6d94a9f8a593bd8b7031650802084385d4ee03.

• CVE-2026-52757MEDIUM 4.4

  Ghidra, the National Security Agency's widely-used reverse-engineering and binary analysis platform, contains a memory safety bug in its decompiler. When a specially crafted binary file is opened in Ghidra's decompiler view, the application can access memory that has already been freed, potentially corrupting data or crashing the program. An attacker would need to distribute a malicious binary and convince a user to analyze it in Ghidra—the vulnerability itself does not allow remote code execution or network-based attacks.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-10636LOW 3.7

  Zephyr's IPv4 IGMP implementation contains a use-after-free vulnerability in its packet handling logic. After sending an IGMP message, the code attempts to read network interface information from a packet that may have already been freed and returned to memory pools by the network driver or stack. This can happen because the packet's last reference is released during transmission, but the code still tries to access it afterward. The issue is reachable by sending IGMP membership queries to the multicast address 224.0.0.1, or through local multicast operations, without requiring authentication. The practical result is typically unpredictable system behavior, potential crashes, or corruption of network statistics counters.

• CVE-2026-56376LOW 3.7

  ImageMagick versions before 7.1.2-15 and 6.9.13-40 contain a memory safety flaw in the meta coder component. When processing certain crafted image files, the application may attempt to write data to memory that has already been freed, especially when internal memory allocation fails. An attacker can exploit this by sending specially designed images to trigger the flaw remotely, causing the ImageMagick process to crash and denying service to legitimate users.