By weakness (CWE)

CWE-416: related vulnerabilities

CVEs classified under CWE-416. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

572 published vulnerabilities · page 5 of 6

Known exploited (KEV)Critical High Medium All recent

CVE-2026-53259HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's IPv6 anycast address handling. When adding IPv6 anycast addresses, a race condition allows the kernel to insert an address into a global hash table after a concurrent teardown process has already removed it from the per-device list and released it. This creates a window where freed memory remains linked in the hash, and subsequent readers encounter dangling pointers. The vulnerability requires local access and can lead to kernel crashes or privilege escalation. The fix moves hash insertion inside the lock-protected section to ensure atomicity with device teardown operations.
CVE-2026-53264HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's traffic control action subsystem. When network filter operations are added and removed at the same time on different CPU cores, a race condition can allow one operation to access memory that has already been freed by another. This occurs because the code freed action objects immediately rather than deferring cleanup until it was safe to do so. The fix restores deferred freeing using RCU (Read-Copy-Update) synchronization, ensuring memory is only reclaimed after all concurrent readers have completed.
CVE-2026-53272HIGH 7.8
CVE-2026-53272 is a use-after-free vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation. The flaw occurs when I/O completion and filesystem unmount operations race against each other. Specifically, when a decompression operation finishes, the kernel queues work to decompress data asynchronously. However, if the filesystem is unmounting simultaneously, the kernel may free the filesystem's metadata structure (sbi) before that queued work tries to access it, causing a crash or potential privilege escalation. This is a local vulnerability requiring an attacker to have user-level access to the system.
CVE-2026-53273HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's TEE (Trusted Execution Environment) OptEE subsystem. When a client process terminates before the supplicant (a background service that handles TEE requests) finishes processing, the client may free request data while the supplicant still holds a reference to it. This creates a race condition where the supplicant attempts to access memory that has already been deallocated, potentially allowing privilege escalation or system compromise. The vulnerability stems from a prior fix that made client waits killable during shutdown, inadvertently changing the expected lifetime of request objects.
CVE-2026-53276HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's Bluetooth ISO implementation. When a socket is being rebound, the code releases a lock while still holding a cached pointer to a connection structure. Between the unlock and the next lock acquisition, a concurrent close operation can destroy that connection and deallocate its memory. The code then attempts to use the freed pointer, causing a crash or potential code execution. The issue affects local attackers with basic privileges who can interact with Bluetooth ISO sockets on the affected system.
CVE-2026-53290HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's GPU display driver (xe) within the EU stall stream closure routine. When a GPU monitoring stream is closed, the driver releases a reference to the device before fully shutting down and freeing the stream's resources. If this causes the device structure to be deallocated prematurely, subsequent cleanup code attempts to access memory that has already been freed, potentially leading to kernel crashes or privilege escalation. This flaw affects systems using the Intel Xe GPU driver on Linux and requires local access and user-level privileges to exploit.
CVE-2026-53296HIGH 7.8
A memory management flaw in the Linux kernel's mailbox-test driver can leak allocated channels and create use-after-free conditions when the driver fails to initialize. The vulnerability arises because error handling during probe does not properly release channels that were obtained before the failure occurs. Since the containing client structure is managed by the kernel's device resource (devm) system, it gets cleaned up automatically; however, the channels it references are not, leaving dangling pointers and wasted memory. This affects systems running vulnerable Linux kernel versions where the mailbox-test module is loaded.
CVE-2026-53300HIGH 7.8
A use-after-free vulnerability exists in the Linux kernel's ENETC network driver. When a network command times out, the driver can free a memory buffer while the hardware is still trying to write to it. This can corrupt memory if the freed buffer gets reallocated to another part of the system. The fix converts a locking mechanism from a spinlock to a mutex, introduces proper tracking of DMA buffers, and ensures locks are held during the critical window when responses are being consumed.
CVE-2026-53341HIGH 7.8
CVE-2026-53341 is a use-after-free vulnerability in the Linux kernel's file handle decoding mechanism. The issue occurs when the kernel accesses mount namespace data without proper synchronization, allowing a concurrent unmount operation to free the memory while it's still being read. This race condition can crash the kernel or potentially leak sensitive information. The vulnerability requires specific kernel configurations (preemption or strict RCU grace periods enabled) to be exploitable in practice.
CVE-2026-56000HIGH 7.8
A local privilege escalation vulnerability exists in X.org's X server and Xwayland that allows an attacker with an existing X connection to crash the display server or potentially execute code with elevated privileges. The flaw stems from how the graphics subsystem manages memory when processing GLX (OpenGL X extension) commit operations, leaving the server vulnerable to use-after-free attacks. An attacker needs local system access and an active X session to exploit this, but no special user interaction is required once those conditions are met.
CVE-2026-57237HIGH 7.8
A vulnerability in PDF applications allows an attacker to crash the software by crafting a malicious PDF file containing JavaScript that modifies form field properties. When the application processes these modifications, internal object references become corrupted, causing the program to access invalid memory and crash. This affects Foxit PDF Editor and Reader, as well as the underlying operating systems (Windows and macOS) that host these applications.
CVE-2026-57238HIGH 7.8
A vulnerability in Foxit PDF Editor and PDF Reader allows a maliciously crafted PDF to crash the application through JavaScript code that deletes form field objects and then attempts to access them. This type of use-after-free flaw can be triggered when a user simply opens a malicious PDF file, requiring no special configuration or user interaction beyond opening the document. The vulnerability affects both products on Windows systems and carries a CVSS score of 7.8 (HIGH severity).
CVE-2026-57240HIGH 7.8
A vulnerability in Foxit PDF Editor and PDF Reader allows an attacker to crash the application by crafting a malicious PDF file that uses JavaScript to delete form fields while the application is processing it. The application continues to reference the deleted fields using stale memory pointers, leading to a crash. This requires user interaction—someone must open the malicious PDF—but no special privileges are needed. While the immediate impact is denial of service through application crash, the underlying memory safety issue could potentially be leveraged for more serious attacks.
CVE-2026-57242HIGH 7.8
CVE-2026-57242 is a high-severity vulnerability affecting Foxit PDF Editor, Foxit PDF Reader, and Microsoft Windows. When JavaScript within a PDF modifies form elements, the application fails to properly manage the lifecycle of related objects on the page and does not validate null values. This causes the application to repeatedly attempt to access invalid objects as the page state changes, ultimately crashing the application. An attacker can exploit this by crafting a malicious PDF that, when opened, triggers the crash. This is a local, user-interaction-dependent attack that could be used for denial of service or as part of a larger attack chain.
CVE-2026-57244HIGH 7.8
A vulnerability in Foxit PDF Editor and Reader allows an attacker to crash the application by exploiting a flaw in how the software handles form resets triggered by JavaScript. When a form is reset, the application fails to properly verify that internal objects still exist before attempting to use them, leading to a memory access error that crashes the program. An attacker can exploit this by crafting a malicious PDF file that, when opened by a user, triggers this crash condition.
CVE-2026-57245HIGH 7.8
A flaw in Foxit PDF Editor and Foxit PDF Reader allows malicious PDF files to crash the application. When these applications process a PDF with specially crafted hyperlink annotation relationships, they fail to properly validate the annotation structure. This causes internal objects to become corrupted, and when the application closes or cleans up resources, an invalid memory write occurs, crashing the program. An attacker can exploit this by crafting a malicious PDF and delivering it to a user.
CVE-2026-57247HIGH 7.8
A use-after-free vulnerability in Foxit PDF Editor and PDF Reader allows local attackers to crash the application and potentially execute code by manipulating document field processing. When a user opens a specially crafted PDF, the application deletes the current page while still holding references to field objects from that page. Continued use of those stale references triggers an illegal memory read, leading to a crash. The vulnerability requires user interaction—opening a malicious PDF file—but no special privileges.
CVE-2026-57249HIGH 7.8
A vulnerability in Foxit PDF Editor and PDF Reader allows an attacker to crash the application by crafting a malicious PDF file that exploits how the software handles form reset operations. When the PDF is opened, the application resets annotation status and then processes a form reset event through additional actions, which can cause it to access memory that has already been freed. This type of memory corruption can lead to application crashes or potentially allow code execution. The vulnerability requires user interaction—a person must open the malicious PDF file—but no special privileges are needed.
CVE-2026-57250HIGH 7.8
A vulnerability in Foxit PDF Editor and PDF Reader allows malicious PDFs to crash the application through a use-after-free condition. When a PDF containing JavaScript resets form fields, the script can re-enter the PDF handler in a way that damages the underlying native object. Because the application fails to validate the object's state before using it, a function call on the corrupted object causes an immediate crash. An attacker can exploit this by crafting a malicious PDF and tricking a user into opening it.
CVE-2026-57252HIGH 7.8
A vulnerability in Foxit PDF Editor and Reader allows an attacker to crash the application by manipulating JavaScript within a PDF file to delete pages and remove attachment annotations. This triggers the attachment panel to access invalid memory pointers, resulting in a denial of service. The attack requires user interaction—the victim must open a malicious PDF—but no special privileges are needed, making it a practical attack vector for social engineering campaigns.
CVE-2026-57256HIGH 7.8
A flaw in PDF applications allows attackers to crash the software by crafting a malicious PDF that exploits how the application handles form fields when JavaScript is involved. When the PDF is opened, the application mismandles internal data structures associated with form objects, leading to a memory access violation that terminates the program. An attacker would need to trick a user into opening the malicious PDF file.
CVE-2026-34192HIGH 7.7
A use-after-free vulnerability exists in GPU memory management that can be triggered by unprivileged users through improper GPU system calls. When the GPU driver encounters an error during certain operations, it fails to properly clean up allocated memory before freeing it, leaving page table structures accessible even after deallocation. An attacker can exploit this to read or corrupt GPU memory, potentially affecting system integrity and data confidentiality.
CVE-2026-41156HIGH 7.7
CVE-2026-41156 is a use-after-free vulnerability in GPU driver firmware interactions that allows a non-privileged user to trigger improper GPU system calls, leading to resource mismanagement and potential system instability or data corruption. The flaw occurs when a CPU driver thread deallocates shared memory before the GPU firmware has finished accessing it, creating a race condition that can be exploited locally without requiring elevated privileges.
CVE-2026-60002HIGH 7.7
OpenSSH clients before version 10.4 are vulnerable to a use-after-free memory error that occurs when a server changes its host key during the key re-exchange phase of an SSH connection. This defect allows an attacker to potentially read sensitive data or crash the client application. The vulnerability is triggered only on the client side and requires specific conditions during the key exchange negotiation to exploit.
CVE-2025-60467HIGH 7.5
GPAC Project's MP4Box, a multimedia framework tool, contains a flaw where freed memory is inadvertently accessed during specific filter cleanup operations. An attacker can exploit this by providing a maliciously crafted media file, crashing the application and disrupting service availability. This vulnerability affects versions before 26.02.0.
CVE-2026-10003HIGH 7.5
A use-after-free vulnerability in Chrome's Views component allows attackers to execute arbitrary code on affected systems. The flaw requires user interaction—specifically, the victim must perform particular UI gestures after being convinced to visit a malicious webpage. Once triggered, the vulnerability grants the attacker the same privileges as the user running the browser, potentially leading to complete system compromise.
CVE-2026-10005HIGH 7.5
Google Chrome on macOS contains a use-after-free vulnerability in its WebAppInstalls component that can be exploited to execute arbitrary code. An attacker would need to convince a user to perform specific gestures within a crafted HTML page to trigger the flaw. This affects Chrome versions prior to 148.0.7778.216.
CVE-2026-10899HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's Ozone display system on Linux that could allow an attacker to corrupt the browser's memory. If a user is tricked into performing specific UI interactions on a malicious webpage, the attacker could potentially execute code or crash the browser. This flaw affects Chrome versions prior to 149.0.7827.53 on Linux systems.
CVE-2026-10900HIGH 7.5
A use-after-free flaw in Google Chrome's password management feature on macOS allows attackers to corrupt memory and potentially execute code if they trick a user into performing specific interactions with a malicious webpage. The vulnerability requires user interaction and affects Chrome versions before 149.0.7827.53. While rated HIGH by CVSS, the attack surface is narrowed by the need for deliberate user gestures and the complexity of reliable exploitation.
CVE-2026-10901HIGH 7.5
A use-after-free memory flaw exists in Google Chrome's password manager on macOS. An attacker can trigger the vulnerability by convincing a user to interact with a specially crafted webpage in specific ways—for example, through unusual clicking patterns or drag-and-drop actions in the password UI. Successful exploitation allows remote code execution with the privileges of the Chrome process. This is a memory safety issue where the browser continues to reference password manager data after it has been freed, creating an opportunity for malicious code injection.
CVE-2026-10906HIGH 7.5
Google Chrome contains a use-after-free vulnerability in its WebAuthentication implementation that can lead to heap memory corruption. An attacker must craft a malicious HTML page and convince a user to interact with it in a specific way—such as clicking or gesturing within the web interface—to trigger the flaw. Successfully exploiting this could allow the attacker to execute arbitrary code or crash the browser. The vulnerability affects Chrome versions before 149.0.7827.53.
CVE-2026-11154HIGH 7.5
A use-after-free flaw in Google Chrome's Dawn graphics component allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox and potentially gain system-level access. The vulnerability requires the attacker to trick a user into opening a malicious webpage and demands prior compromise of the renderer process, making it a two-stage attack. Patching to Chrome 149.0.7827.53 or later closes this gap.
CVE-2026-11632HIGH 7.5
A use-after-free flaw in Google Chrome's TabStrip component allows attackers to run arbitrary code on a victim's computer. The vulnerability requires an attacker to craft a malicious webpage and convince a user to perform specific interactions (like clicking or dragging tabs) to trigger the bug. Successful exploitation could give an attacker complete control over the affected system, including access to sensitive data, installation of malware, or lateral movement to other systems on the network.
CVE-2026-11636HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's Autofill feature on Windows systems. An attacker can craft a malicious HTML page that, when combined with specific user interactions, may trigger memory corruption leading to code execution. The vulnerability requires user interaction—specifically certain UI gestures—to be exploited, but once triggered, the impact is severe. Chrome versions prior to 149.0.7827.103 are affected.
CVE-2026-11639HIGH 7.5
A use-after-free memory safety flaw exists in Google Chrome's compositing engine on macOS. If you visit a malicious webpage, an attacker could exploit this vulnerability to run arbitrary code on your system with the privileges of the Chrome process. The vulnerability was patched in Chrome 149.0.7827.103 and later versions.
CVE-2026-11641HIGH 7.5
A memory safety flaw in Google Chrome's Bluetooth implementation on Windows allows attackers to crash the browser or run malicious code if they can trick a user into specific interactions with a specially crafted webpage. The vulnerability requires user action and doesn't grant automatic exploitation, but once triggered, it could give an attacker full control over the affected browser process and any data within it.
CVE-2026-11644HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's Views component on Linux systems. An attacker could exploit this by tricking a user into installing a malicious Chrome extension, which could then execute arbitrary code with the privileges of the Chrome process. This represents a critical-severity issue from Chromium's perspective, though the CVSS score reflects the requirement for user interaction (extension installation) as a limiting factor.
CVE-2026-11694HIGH 7.5
A use-after-free flaw in Google Chrome's ServiceWorker implementation could allow an attacker who has already compromised the renderer process to run malicious code within the sandbox. The vulnerability requires user interaction (visiting a specially crafted webpage) but poses a direct path to code execution for an attacker with partial system access.
CVE-2026-12245HIGH 7.5
NSD, a DNS nameserver software maintained by NLnet Labs, contains a memory safety defect that causes the server to crash when processing certain DNS-over-TLS (DoT) connections. An attacker can trivially trigger this crash by opening a DoT connection, sending a DNS query, and closing the connection before the response is read. The underlying issue is improper memory cleanup during error logging on these connections, allowing the freed memory to be accessed after it has been deallocated. While this does not enable data theft or system compromise, repeated crashes can degrade service availability.
CVE-2026-12310HIGH 7.5
A memory safety vulnerability was discovered in Firefox and Thunderbird that allows an attacker to read sensitive information from an affected system without requiring user interaction or special privileges. The flaw stems from improper memory handling in the browser engine and has been patched in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. No active exploitation has been reported to CISA as of this analysis.
CVE-2026-12314HIGH 7.5
A memory safety vulnerability in Firefox and Thunderbird allows an attacker to read sensitive data from affected browsers without user interaction. The flaw stems from unsafe memory handling that permits out-of-bounds reads. An attacker on the network can exploit this remotely to compromise the confidentiality of user data—such as cached credentials, browsing history, or page content—without requiring the user to click a malicious link or perform any action. The vulnerability does not enable data modification or system crashes.
CVE-2026-12445HIGH 7.5
Google Chrome versions before 149.0.7827.155 contain a use-after-free vulnerability in the Extensions subsystem. An attacker can exploit this by tricking a user into installing a malicious Chrome extension, potentially leading to heap corruption and arbitrary code execution on the victim's machine. The vulnerability requires user interaction (extension installation) but poses significant risk because users may not scrutinize extension permissions closely.
CVE-2026-12455HIGH 7.5
A use-after-free memory vulnerability exists in Google Chrome's tab strip component that could allow an attacker to corrupt the browser's heap memory. The attack requires convincing a user to perform specific UI actions (such as interacting with tabs in a particular sequence) while viewing a malicious webpage. If exploited successfully, an attacker could gain the ability to read sensitive data, modify browser behavior, or crash the application. This vulnerability affects Chrome versions prior to 149.0.7827.155 across Windows, macOS, and Linux systems.
CVE-2026-12462HIGH 7.5
A use-after-free vulnerability in Chrome's media handling allows an attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox. The vulnerability requires user interaction (such as opening a malicious HTML page) but poses a serious risk because it enables code execution even when the renderer is already isolated from the system. This vulnerability affects Chrome versions prior to 149.0.7827.155.
CVE-2026-13029HIGH 7.5
A use-after-free flaw in Chrome's Web Authentication system allows attackers to corrupt the browser's heap memory. The vulnerability requires both user interaction—tricking someone into installing a malicious Chrome extension—and the extension itself to be crafted specifically to exploit the weakness. If successfully exploited, an attacker could potentially execute arbitrary code within the Chrome process, compromising browsing security and data confidentiality.
CVE-2026-13283HIGH 7.5
Google Chrome on Android contains a use-after-free vulnerability in its AdFilter component that could allow an attacker to run malicious code on a user's device. An attacker would need to trick a user into performing specific touch gestures on a specially crafted webpage to trigger the flaw. This is a memory safety issue where freed memory is accessed, leading to potential code execution with the privileges of the browser process.
CVE-2026-13802HIGH 7.5
Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the Views component that allows an attacker to execute arbitrary code on an affected system. The attack requires a user to visit a specially crafted webpage and perform specific UI interactions—such as clicking or navigating—that trigger the vulnerable code path. While user interaction is required, successful exploitation could grant the attacker full control over the affected Chrome process and any data it can access.
CVE-2026-13807HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's import functionality on iOS. An attacker can exploit this by hosting a malicious file and convincing a user to perform specific gestures (such as importing the file) within the browser. If successful, the attacker gains the ability to run arbitrary code on the affected device with the privileges of the Chrome process. The vulnerability affects Chrome versions before 150.0.7871.47.
CVE-2026-13814HIGH 7.5
Google Chrome versions prior to 150.0.7871.47 contain a use-after-free vulnerability in the Views component that can lead to heap corruption. An attacker would need to craft a malicious HTML page and socially engineer a user into performing specific UI interactions to trigger the flaw. If exploited, this could allow code execution or data theft on the affected machine.
CVE-2026-13831HIGH 7.5
A memory safety vulnerability in Google Chrome's GPU processing component allows an attacker who has already compromised a Chrome renderer process to break out of the sandbox and execute arbitrary code with elevated privileges. The vulnerability stems from improper bounds checking in GPU memory operations, allowing out-of-bounds read and write access. An attacker would need to deliver a malicious HTML page to a user and have that page run within an already-compromised renderer context to exploit this flaw.
CVE-2026-13855HIGH 7.5
A use-after-free vulnerability exists in the Ozone subsystem of Google Chrome on Linux. An attacker can exploit this by crafting a malicious webpage that tricks a user into performing specific mouse or keyboard gestures, leading to arbitrary code execution on the affected system. The vulnerability requires user interaction but allows full compromise of the browser process and potentially the underlying system.
CVE-2026-14064HIGH 7.5
A use-after-free flaw in Chrome's PageInfo component on Android allows attackers to run malicious code on affected devices. The attack requires social engineering—convincing a user to perform specific UI interactions with a specially crafted webpage. While the underlying defect is classified as 'Low' severity by Chromium, the potential for complete system compromise (data theft, modification, or disruption) combined with the user interaction requirement results in a HIGH CVSS score of 7.5.
CVE-2026-14426HIGH 7.5
A use-after-free flaw in Google Chrome's V8 JavaScript engine allows attackers to execute code within the browser's sandbox if they trick a user into performing specific UI interactions on a malicious webpage. The attack requires both a crafted HTML page and active user participation, making it a targeted rather than passive threat. Chrome versions prior to 150.0.7871.46 are vulnerable.
CVE-2026-15111HIGH 7.5
A use-after-free memory vulnerability exists in Google Chrome's rendering engine that could allow an attacker to corrupt heap memory and potentially execute code if a user interacts with a specially crafted webpage in specific ways. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires user interaction to exploit, but successful exploitation could lead to data theft, system compromise, or denial of service.
CVE-2026-15117HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's Payments feature that could allow an attacker to corrupt computer memory if a user is tricked into performing specific interactions with a malicious webpage. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires the attacker to craft a deceptive HTML page and convince the user to engage in particular UI gestures. If successfully exploited, an attacker could potentially read sensitive data, modify system behavior, or crash the browser.
CVE-2026-42909HIGH 7.5
A race condition flaw in Microsoft's Remote Desktop Client and related Windows components allows an attacker to execute malicious code on a target machine over the network. The vulnerability requires the user to interact with a malicious connection or file, but once triggered, grants the attacker the same privileges as the logged-in user. This affects multiple versions of Windows 10, Windows 11, Windows Server, and the standalone Windows App, making it a broad-reaching concern across enterprise environments.
CVE-2026-42913HIGH 7.5
A race condition flaw in Remote Desktop Client allows an attacker to execute arbitrary code on a Windows system by exploiting a window between when two processes access shared resources without proper locking. The attack requires network access and user interaction (such as establishing an RDP session), but successfully exploiting it grants full code execution with the privileges of the Remote Desktop Client process. This affects multiple Windows 11 versions and Windows Server 2022/2025.
CVE-2026-44422HIGH 7.5
FreeRDP, a widely-used open-source Remote Desktop Protocol client, contains a memory corruption vulnerability in its authentication-redirection subsystem. A malicious RDP server can craft specially-formed authentication data that causes the FreeRDP client to allocate a single heap object but then attempt to free it twice—or use it after the first deallocation. This occurs because the parser doesn't properly track which heap objects correspond to which data structures when the same object reference is reused. The result is a crash or potential code execution on the client machine. The vulnerability requires user interaction (connecting to a malicious server) but affects all FreeRDP versions before 3.26.0.
CVE-2026-44801HIGH 7.5
A use-after-free vulnerability in Microsoft's Remote Desktop Client and Windows versions allows an attacker to execute code on your computer over the network. The flaw requires user interaction (such as clicking a link or opening a file) and specific system conditions, but once triggered, grants full control of the affected machine. This affects Remote Desktop Client, Windows App, and multiple Windows 10, 11, and Server editions.
CVE-2026-47654HIGH 7.5
A use-after-free memory vulnerability exists in the Remote Desktop Client component across multiple Windows Server versions. An attacker can exploit this flaw to execute arbitrary code on a target system over the network. The attack requires user interaction—specifically, a user must open a malicious RDP connection or file—but once triggered, an unauthenticated attacker gains the ability to run code with the privileges of the affected user. This is a network-reachable vulnerability with no authentication requirement, making it a material risk for organizations using Remote Desktop services.
CVE-2026-48563HIGH 7.5
A use-after-free bug in Microsoft's Remote Desktop Client can allow an attacker to run malicious code on a victim's machine over the network. The attacker would need to trick the user into connecting to a compromised or malicious Remote Desktop server, but once successful, they gain full control. This affects Windows 10 and Windows 11 systems, as well as Windows Server 2019, 2022, and 2025.
CVE-2026-57435HIGH 7.5
Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety vulnerability in versions prior to 1.19.4. When an application modifies an XML attribute's value after the attribute node has been accessed by Ruby code, Nokogiri's native extension can inadvertently free memory that is still referenced elsewhere. This orphaned pointer can later cause the application to crash or behave unpredictably when the freed memory is accessed. The vulnerability requires no user interaction and can be triggered remotely if the affected code processes untrusted XML input.
CVE-2026-57585HIGH 7.5
MessagePack, a popular serialization library for Python, contains a defect in how it handles repeated use of the Unpacker object after an error occurs. When an Unpacker instance encounters a parsing error and is then reused to process more data, it can read from invalid memory locations, causing the process to crash. This denial-of-service condition affects applications that parse untrusted MessagePack data in a loop or that implement retry logic without properly reinitializing the Unpacker. The vulnerability is resolved in version 1.2.1 and later.
CVE-2026-57984HIGH 7.5
Microsoft Edge (the Chromium-based version) contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a user's machine when they visit a malicious webpage. The vulnerability requires user interaction—specifically visiting a crafted site—but does not require any special authentication or privileges. While the code execution happens over the network, the attack surface is limited by the need for a specific browser interaction and moderately complex exploit conditions, reflected in its CVSS score of 7.5 (HIGH).
CVE-2026-57986HIGH 7.5
Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that could allow an attacker to execute code on a user's computer through the network. The vulnerability requires user interaction, such as viewing a malicious webpage, but once triggered grants the attacker full control over the browser and potentially the underlying system. This is a memory corruption issue where the browser attempts to use memory that has already been freed, leading to unpredictable behavior that an attacker can exploit.
CVE-2026-57992HIGH 7.5
Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a user's system through a specially crafted network interaction. The vulnerability requires user interaction (such as visiting a malicious webpage) to trigger, but does not require authentication. Successful exploitation could grant an attacker the same privileges as the logged-in user, potentially enabling data theft, system compromise, or further attacks.
CVE-2026-58276HIGH 7.5
A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an attacker to execute arbitrary code on a user's system by sending a specially crafted network message. The attack requires user interaction—such as visiting a malicious webpage or opening a crafted link—but does not require the attacker to be authenticated or have prior access to the system. Successful exploitation could give an attacker full control over the affected browser process and potentially the underlying machine.
CVE-2026-58294HIGH 7.5
Microsoft Edge (Chromium-based) contains a use-after-free memory safety defect that allows an attacker to execute arbitrary code on a user's system through the network. The vulnerability requires user interaction (such as visiting a malicious webpage) and relies on moderately complex attack conditions, but successful exploitation grants full system compromise. This is a memory corruption issue where freed memory is accessed improperly, a common source of serious security defects in browser engines.
CVE-2026-8829HIGH 7.5
HTML::Entities, a widely-used Perl library for encoding and decoding HTML entities, contains a use-after-free vulnerability in versions before 3.84. The flaw occurs in the internal _decode_entities function when processing specially crafted entity-reference strings. Under specific conditions—when the input string matches a cached entity value that contains a self-referential entity—the library can read from memory that has already been freed. This potentially exposes adjacent heap contents to an attacker, creating a limited information disclosure risk.
CVE-2026-9901HIGH 7.5
A use-after-free flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker to run malicious code on a target's machine. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that draws web content), and the victim must then visit a specially crafted web page. Once both conditions are met, arbitrary code can execute with the privileges of the compromised renderer process. This affects Chrome versions before 148.0.7778.216.
CVE-2026-9922HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's GPU rendering engine on macOS. The flaw allows an attacker who has already compromised Chrome's renderer process to execute arbitrary code by serving a specially crafted HTML page. This is a post-compromise risk: the attacker must first break into the renderer sandbox, but if successful, can then escalate to full code execution with system privileges. The vulnerability affects Chrome versions prior to 148.0.7778.216 on macOS.
CVE-2026-9933HIGH 7.5
CVE-2026-9933 is a use-after-free memory vulnerability in Google Chrome's input handling code that allows attackers to corrupt heap memory on affected systems. Exploitation requires an attacker to trick a user into performing specific UI interactions (such as unusual mouse or keyboard gestures) while viewing a specially crafted HTML page. This is not a passive drive-by attack; active user participation is required. If successfully exploited, an attacker could execute arbitrary code with the privileges of the Chrome process, leading to complete compromise of the affected user's system.
CVE-2026-9934HIGH 7.5
A use-after-free memory flaw exists in Google Chrome's Aura component (which handles window management and input) before version 148.0.7778.216. An attacker could exploit this by convincing a user to interact with a specially crafted webpage using specific mouse or keyboard gestures. Successful exploitation would allow the attacker to run arbitrary code on the victim's machine with the privileges of the Chrome process.
CVE-2026-9954HIGH 7.5
A use-after-free vulnerability exists in Google Chrome's TabStrip component that can lead to memory corruption. An attacker must trick a user into performing specific UI interactions (like clicking or dragging tabs in a particular sequence) on a malicious website to potentially trigger the flaw. Successful exploitation could allow the attacker to read sensitive data, modify page content, or crash the browser. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux.
CVE-2026-9956HIGH 7.5
A use-after-free vulnerability in Google Chrome on iOS allows remote attackers to execute arbitrary code if a user can be tricked into performing specific gestures on a malicious webpage. The vulnerability requires user interaction but doesn't require special privileges or system access, making it a realistic attack vector for threat actors hosting compromised or attacker-controlled sites.
CVE-2026-9990HIGH 7.5
Google Chrome on macOS contains a use-after-free vulnerability in its web app installation feature that could allow an attacker to corrupt memory on a user's system. The vulnerability requires a user to perform specific interactions with a malicious webpage, but once triggered, it could potentially give an attacker the ability to read sensitive data, modify files, or crash the browser. The issue affects Chrome versions before 148.0.7778.216 on Mac systems.
CVE-2026-10646HIGH 7.4
Zephyr's DNS socket implementation contains a use-after-return vulnerability in its getaddrinfo() function. When a DNS query times out and is retried, the code fails to properly clean up the previous query before starting a new one. This leaves a stale callback pointing to an expired stack memory location. When a DNS response arrives—whether from a legitimate delayed resolver or spoofed by an attacker on the network—it triggers the dangling callback, which then writes data into memory that has already been reused by other functions. An attacker can exploit this via crafted or replayed DNS responses to corrupt memory, crash the system, or potentially execute code. This affects Zephyr versions 4.0.0 through 4.4.0.
CVE-2026-57589HIGH 7.4
A use-after-free vulnerability exists in OpenBSD's System V semaphore implementation that allows a local attacker with no special privileges to escalate to root access. The flaw occurs when a process calls semget() and enters a sleep state; under specific timing conditions during context switching, freed memory can be accessed, compromising system integrity. This is a local attack requiring code execution on the target system but no prior privileges.
CVE-2026-11115HIGH 7.3
A use-after-free vulnerability exists in Google Chrome's update mechanism on Windows systems. An attacker with local access can exploit this flaw by crafting a malicious file, potentially escalating their privileges to system or administrator level. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (such as opening or running a file) to trigger the exploit.
CVE-2026-48913HIGH 7.3
Apache HTTP Server's HTTP/2 module (mod_http2) contains a use-after-free vulnerability that can be triggered when the system runs out of available file handles. An unauthenticated attacker on the network can exploit this flaw to cause memory corruption, potentially leading to information disclosure, data modification, or service disruption. The vulnerability affects versions 2.4.55 through 2.4.67 of Apache HTTP Server.
CVE-2026-6040HIGH 7.3
CVE-2026-6040 is a memory safety vulnerability in ODF (Open Document Format) number format parsing. When a document contains a malformed number format with blank-width characters, a position value embedded in that format is not validated before being used to access the format-code string. This can cause the application to read from memory outside the intended buffer—a use-after-free condition. An attacker who crafts a malicious ODF document with a specially formed number format could trigger this flaw, potentially leading to information disclosure, data corruption, or application crash when the document is opened by a user.
CVE-2026-9080HIGH 7.3
A use-after-free bug in libcurl allows attackers to crash applications or potentially execute code when specific callback functions are invoked during multi-socket operations. The vulnerability is triggered when `curl_easy_pause()` is called from within libcurl's event-based socket callback handler, causing the library to write to memory that has already been freed. This is a memory safety issue that affects applications using libcurl's multi interface with socket callbacks.
CVE-2026-53040HIGH 7.1
A flaw in the Linux kernel's OCFS2 filesystem driver can be triggered when a user issues a specific diagnostic request (OCFS2_IOC_INFO with non-coherent mode) against a crafted filesystem. An attacker with local access can supply malformed filesystem metadata that causes the kernel to read memory outside the bounds of a bitmap structure, leading to a use-after-free condition. This can crash the system or potentially allow information disclosure. The vulnerability requires local access and standard user privileges to trigger.
CVE-2026-0125HIGH 7.0
CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.
CVE-2026-34335HIGH 7.0
A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.
CVE-2026-42836HIGH 7.0
A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.
CVE-2026-42911HIGH 7.0
A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.
CVE-2026-42984HIGH 7.0
A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.
CVE-2026-45596HIGH 7.0
A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.
CVE-2026-45601HIGH 7.0
A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.
CVE-2026-45603HIGH 7.0
A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.
CVE-2026-45640HIGH 7.0
A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.
CVE-2026-45653HIGH 7.0
A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.
CVE-2026-46154HIGH 7.0
A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.
CVE-2026-47293HIGH 7.0
A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.
CVE-2026-49417HIGH 7.0
A use-after-free vulnerability in FreeBSD's audio device handling allows unprivileged local users to read and write kernel memory. When an audio device is closed, its backing buffer may be freed while memory mappings remain valid, leaving the process able to access the freed region. Since audio device nodes are world-accessible by default, any local user with access to the system can exploit this to either escalate privileges to gain full system control or crash the kernel, causing a denial of service.
CVE-2026-11628MEDIUM 6.8
Google Chrome versions before 149.0.7827.103 contain a use-after-free memory error in the Ozone graphics subsystem. An attacker with physical access to a device can trigger this flaw to corrupt heap memory and potentially execute arbitrary code. While the Chromium project rates this as Critical, the CVSS score reflects the requirement for physical device access, which limits real-world exploitability for most organizations.
CVE-2026-13282MEDIUM 6.8
A use-after-free flaw in Google Chrome's Payments feature on Android devices could allow an attacker with physical access to the device to corrupt memory and potentially execute malicious code. The vulnerability affects Chrome versions prior to 149.0.7827.201 and requires the attacker to have direct, hands-on access to the Android device. While the underlying Chromium security team rated this as High severity, the CVSS score reflects the practical constraint that exploiting it demands physical presence—a meaningful limitation in most enterprise and consumer threat models.
CVE-2026-13595MEDIUM 6.8
A memory safety bug in libblkid—a core Linux utility library responsible for identifying and reading partition tables—allows an attacker to trigger a use-after-free condition by inserting a specially crafted block device. When libblkid probes nested partitions (partitions within partitions), it caches a memory address pointing to partition information. If the system then discovers additional partitions and reallocates internal memory structures, that cached address becomes invalid. Subsequent reads from that stale pointer can leak sensitive information from kernel memory or crash the system. The risk is amplified because libblkid runs automatically with root privileges during USB insertion or when users mount disk images—no manual intervention required.
CVE-2025-59615MEDIUM 6.6
CVE-2025-59615 is a memory corruption vulnerability affecting Qualcomm wireless connectivity and processing platforms. The flaw arises from improper synchronization when device drivers handle input/output control operations for mapping and unmapping persistent memory buffers. An attacker with local system access and user-level privileges could exploit this to corrupt memory, potentially leading to data leakage, system instability, or privilege escalation. Exploitation requires elevated user interaction on the targeted system.