By weakness (CWE)

CWE-416: related vulnerabilities

CVEs classified under CWE-416. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

572 published vulnerabilities · page 6 of 6

• CVE-2025-59616MEDIUM 6.6

  A memory safety flaw exists in multiple Qualcomm wireless and mobile platforms where improper cleanup of input buffers allows a local attacker with limited privileges to trigger a use-after-free condition. By sending multiple IOCTL commands that reference the same buffer file descriptor, an attacker can cause the system to access memory that has already been freed, potentially leading to information disclosure, system instability, or code execution in a restricted context.

• CVE-2025-59617MEDIUM 6.6

  A memory safety defect in Qualcomm wireless connectivity and mobile platform firmware allows a local attacker with standard user privileges to corrupt memory by sending multiple IOCTL (input/output control) commands through the same file descriptor. This flaw can lead to unauthorized disclosure of sensitive data, unauthorized modification of system state, or denial of service. The vulnerability requires both user interaction and specific timing conditions to exploit successfully.

• CVE-2026-57438MEDIUM 6.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a memory safety flaw in its XInclude feature. When the library processes XInclude directives (a standard XML feature that lets documents reference external content), it frees memory without properly notifying Ruby objects that may still reference it. If your application code has kept a reference to a fallback element or namespace from an included file, using that reference afterward can read from or write to memory that's no longer valid, potentially causing crashes or unexpected behavior.

• CVE-2026-10655MEDIUM 6.5

  A race condition in Zephyr's SNTP (Simple Network Time Protocol) client can cause a networking thread crash when the asynchronous socket close operation runs on a different thread than the socket service's polling thread. An attacker on the network or positioned to intercept traffic can trigger this condition repeatedly by dropping or delaying SNTP responses, causing the system to repeatedly attempt reconnection and hitting the race window. While memory corruption is theoretically possible, denial of service via crash is the primary risk.

• CVE-2026-11073MEDIUM 6.5

  A use-after-free vulnerability exists in Google Chrome's WebGL rendering engine that could allow an attacker to steal sensitive data from your browser's memory. An attacker would need to trick you into visiting a malicious webpage to exploit this flaw. While the vulnerability requires user interaction to trigger, the potential exposure of process memory—which may contain cached passwords, authentication tokens, or other sensitive information—makes it a meaningful security concern. The issue affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11208MEDIUM 6.5

  A use-after-free vulnerability exists in the codec handling components of Google Chrome versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to read sensitive data directly from the browser process's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require any special privileges to exploit.

• CVE-2026-12706MEDIUM 6.5

  FFmpeg, a widely used multimedia framework, contains a use-after-free vulnerability in its RASC video decoder. When processing a specially crafted AVI file with malicious RASC video data, the decoder's move-table handling can inadvertently free memory that is still being read by the decode function. This causes the application to access invalid memory locations, typically resulting in a crash. An attacker needs only to trick a user into opening or playing a malicious video file—no special privileges or complex attack setup required.

• CVE-2026-13879MEDIUM 6.5

  Google Chrome contains a use-after-free memory vulnerability in its Bluetooth implementation that allows attackers on the same local network to extract sensitive data from the browser's memory by using a specially crafted Bluetooth device. This occurs before Chrome version 150.0.7871.47. The vulnerability is rated Medium severity and does not affect system stability or enable attackers to modify data, but it does create a risk of information disclosure from process memory.

• CVE-2026-14048MEDIUM 6.5

  A use-after-free flaw in Google Chrome's Chromecast component allows an attacker positioned on the same local network to extract sensitive data from the browser's memory using a specially crafted malicious peripheral device. The vulnerability affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14103MEDIUM 6.5

  A use-after-free memory flaw in Google Chrome's SSL/TLS implementation on ChromeOS allows an attacker to craft a malicious webpage that, when visited, can leak sensitive data from the browser's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require authentication and can run over the network. Chrome versions before 150.0.7871.47 are affected. While Chromium's security team rated this as Low severity, the CVSS 3.1 score of 6.5 reflects the potential for meaningful confidentiality impact.

• CVE-2026-39872MEDIUM 6.5

  CVE-2026-39872 is a memory handling flaw in Apple's Safari browser and related operating systems that can crash the application when processing malicious web content. An attacker would need to trick a user into visiting a crafted webpage, but no additional privileges or special conditions are required. The crash itself does not compromise data confidentiality or integrity—it simply denies availability of the browser temporarily. This is a moderate-severity issue affecting Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-43663MEDIUM 6.5

  CVE-2026-43663 is a memory handling vulnerability affecting Safari and multiple Apple operating systems. When a user visits or interacts with a maliciously crafted website, the affected application can crash unexpectedly. While the crash itself prevents normal operation, the vulnerability does not enable attackers to steal data or take control of the device—it is primarily a denial-of-service issue triggered by user interaction with hostile web content.

• CVE-2026-43699MEDIUM 6.5

  A use-after-free memory vulnerability affects Apple's Safari browser and iOS/iPadOS/macOS platforms. An attacker can craft malicious web content that, when processed by a vulnerable browser, causes unexpected crashes. The vulnerability requires user interaction—specifically, visiting a malicious website—but does not enable data theft or system compromise beyond denial of service. Apple has released patched versions addressing the underlying memory management flaw.

• CVE-2026-43709MEDIUM 6.5

  Apple has patched a use-after-free memory vulnerability in Safari and multiple operating systems that could crash applications when processing malicious web content. An attacker would need to trick a user into visiting a crafted website, but no user interaction beyond standard browsing is required to trigger the crash. The vulnerability does not enable data theft or system compromise—only denial of service through application termination.

• CVE-2026-43716MEDIUM 6.5

  A memory handling flaw in Apple's Safari browser and related Apple platforms can crash the browser when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website; the crash itself does not enable data theft or system compromise, but it does disrupt service. Apple has released patches addressing the underlying memory issue across Safari, iOS, iPadOS, and macOS.

• CVE-2026-43717MEDIUM 6.5

  A use-after-free memory vulnerability exists in Apple's Safari browser and related operating systems. An attacker can craft a malicious webpage that, when visited, causes Safari to crash unexpectedly. The vulnerability does not enable data theft or system compromise—it is limited to availability impact (denial of service via crash). Exploitation requires user interaction: the victim must visit or be directed to the malicious web content.

• CVE-2026-43720MEDIUM 6.5

  A use-after-free memory vulnerability in Apple Safari and related systems allows attackers to crash Safari by tricking users into viewing specially crafted web content. The flaw stems from improper memory management that leaves dangling references to freed memory, which attackers can exploit to trigger an unexpected application crash. While the vulnerability requires user interaction (visiting a malicious website), it affects a widely used browser across multiple Apple platforms.

• CVE-2026-43726MEDIUM 6.5

  A use-after-free memory vulnerability in Apple's Safari browser and related operating systems can cause unexpected application crashes when processing maliciously crafted web content. An attacker would need to convince a user to visit a malicious website, but no special privileges or complex setup is required for exploitation. The impact is limited to denial of service through crashes; the vulnerability does not enable data theft or system compromise.

• CVE-2026-43727MEDIUM 6.5

  A use-after-free memory flaw in Apple's Safari browser and related operating systems can crash Safari when processing malicious web content. An attacker would need to trick a user into visiting a crafted webpage, but no authentication or special user privileges are required—standard web browsing is the attack vector. The crash causes a denial of service; there is no evidence of data theft or system compromise from this vulnerability alone.

• CVE-2026-43734MEDIUM 6.5

  A use-after-free memory vulnerability affects Apple's Safari browser and iOS/iPadOS/macOS operating systems. An attacker can craft a malicious webpage that, when visited, causes Safari or the built-in web rendering engine to crash unexpectedly. While the crash itself denies service rather than enabling data theft or system compromise, the vulnerability requires user interaction—the person must visit the malicious site. Apple has issued patches across multiple platforms and device types.

• CVE-2026-43740MEDIUM 6.5

  Apple has patched a memory disclosure vulnerability affecting Safari, iOS, iPadOS, and macOS. When a user visits a maliciously crafted website, the browser can leak sensitive data from its process memory to an attacker. The flaw stems from insufficient memory handling in the browser's web content processing engine. While the vulnerability requires user interaction (visiting a malicious site), the confidentiality risk is significant enough that Apple classified it as MEDIUM severity and issued fixes across multiple platforms simultaneously.

• CVE-2026-43742MEDIUM 6.5

  CVE-2026-43742 is a use-after-free memory vulnerability in Apple's Safari browser and related operating systems. An attacker can craft a malicious website that, when visited by a user, causes Safari or the affected system to crash unexpectedly. The vulnerability requires user interaction (visiting a malicious site) but does not enable data theft or system compromise—it simply stops the browser or app from working. Apple has released patches across its ecosystem to fix the underlying memory management flaw.

• CVE-2026-43746MEDIUM 6.5

  Safari and related Apple operating systems contain a use-after-free memory flaw that can crash the browser when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious webpage, but no special privileges or system access are required. The crash itself does not allow data theft or system compromise—it is a denial-of-service issue. Apple has released patches for Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 that fix the underlying memory management problem.

• CVE-2026-47207MEDIUM 6.5

  Envoy, a widely-used proxy for cloud-native applications, has a vulnerability that causes it to crash when an external processing (ext_proc) server sends a specially crafted message. The issue stems from how Envoy handles multiple responses bundled into a single network message—the first response can trigger cleanup of internal structures, but Envoy then tries to access those structures again when reading subsequent responses, leading to a crash. This affects versions 1.34.0 through 1.38.2, and is resolved in patched releases across multiple version lines.

• CVE-2026-41982MEDIUM 6.4

  CVE-2026-41982 is a race condition vulnerability affecting the IPC (inter-process communication) module. An authenticated attacker can exploit this flaw to degrade system availability. The vulnerability requires specific conditions to trigger and is rated MEDIUM severity with a CVSS score of 6.4.

• CVE-2026-10635MEDIUM 6.3

  CVE-2026-10635 is a use-after-free vulnerability in Zephyr's Xtensa memory domain handling. When a memory domain is destroyed on Xtensa systems with MMU support, the kernel fails to cleanly remove the domain from an internal tracking list, leaving a dangling pointer. If the freed memory is later reused or accessed, kernel code can dereference corrupted data structures, potentially compromising memory isolation between privileged and unprivileged code. The vulnerability requires privileged kernel access to trigger and cannot be exploited directly from user space or remotely.

• CVE-2026-10703MEDIUM 6.3

  A use-after-free memory safety flaw exists in EIPStackGroup OpENer versions up to 2.3.0 within the SendRRData request handler. An authenticated attacker can remotely trigger memory corruption by crafting malicious messages, potentially leading to information disclosure or service disruption. The vulnerability has been publicly disclosed but the vendor has not yet acknowledged or released a patch.

• CVE-2026-46523MEDIUM 6.2

  ImageMagick, widely used image processing software, contains a memory safety defect that can be triggered when processing specially crafted MSL (Magick Scripting Language) image files. The vulnerability allows an attacker with local file access to cause the application to crash or potentially execute code by manipulating freed memory. This affects both the maintained 7.x branch and the legacy 6.x branch before specific patch versions.

• CVE-2025-60465MEDIUM 6.1

  A use-after-free memory vulnerability exists in GPAC's media file processing logic. When MP4Box or the GPAC library processes a specially crafted media file, it can access memory that has already been freed, triggering a crash. An attacker needs only to trick a user into opening a malicious file locally—no network interaction required. The impact is denial of service; while the vulnerability does involve memory corruption, the specific attack vector does not lead to code execution in the current configuration.

• CVE-2026-49496MEDIUM 6.1

  Ghidra, the NSA's open-source reverse engineering framework, contains a memory safety bug in its Sleigh decompilation engine that can corrupt heap memory. When processing malicious binaries, the vulnerability allows an attacker to trigger a use-after-free condition—where the software attempts to access memory that has already been freed. The flaw affects version 12.0 and earlier; upgrading to version 12.1 or later resolves the issue. While exploitation requires user interaction (opening a malicious binary), the memory corruption could lead to application crashes or, in carefully crafted scenarios, potential code execution.

• CVE-2026-10637MEDIUM 5.9

  A vulnerability in Zephyr's IPv6 multicast listener discovery (MLD) implementation allows a remote attacker on the local network to crash the networking stack by sending specially crafted MLD queries. The flaw stems from the code attempting to read and modify packet metadata after the packet has been freed by the network driver, creating a use-after-free condition. An attacker can trigger this without authentication by sending a valid MLDv2 General Query to the device, reliably causing a denial of service.

• CVE-2026-10638MEDIUM 5.9

  A use-after-free vulnerability exists in Zephyr's ICMPv6 network stack. When the kernel sends an ICMPv6 response (such as a reply to a ping or an error message), it tries to update statistics using a packet pointer after that packet has already been freed and returned to memory. An attacker on the network can trigger this by sending a simple ICMPv6 Echo Request or crafting packets that cause IPv6 errors, causing the device to crash or potentially corrupt memory. The flaw affects Zephyr versions roughly 4.2.0 through 4.4.0 when IPv6 networking is enabled.

• CVE-2026-14178MEDIUM 5.9

  A memory safety issue exists in openGauss when processing timestamp conversion functions with locale (NLS) parameters. Specifically, when `to_timestamp()` is called with an NLS format parameter, the database stores formatting information in memory that gets freed after query execution. However, during result output, the code tries to access this already-freed memory, which can cause the database backend process to crash. An attacker with SQL execution privileges can deliberately construct such queries to trigger this crash repeatedly, leading to denial of service. The vulnerability affects RC releases 7.0.0-RC1 and 7.0.0-RC2 and has been fixed in 7.0.0-RC3 and later versions.

• CVE-2026-24266MEDIUM 5.9

  NVIDIA's Triton Inference Server for Linux contains a use-after-free vulnerability that allows attackers to disrupt service availability. The flaw exists in memory management logic, where freed memory is accessed again, potentially causing the application to crash. While the attack requires specific network conditions to exploit reliably, the impact is limited to denial of service rather than data theft or system compromise.

• CVE-2026-47205MEDIUM 5.9

  Envoy, a widely-deployed open source proxy for cloud-native infrastructure, contains a use-after-free defect in its authorization filter that can cause the proxy to crash. The vulnerability occurs when a request uses dynamic per-route authorization settings and the client connection closes very quickly—such as when a user rapidly refreshes a WebSocket connection to a protected endpoint. Under these conditions, Envoy's internal authorization tracking becomes corrupted, leading to a segmentation fault that terminates the affected proxy instance. This flaw affects Envoy versions 1.36.0 through 1.36.8, 1.37.0 through 1.37.4, and 1.38.0 through 1.38.2.

• CVE-2026-48090MEDIUM 5.9

  Envoy, a widely-deployed service proxy for containerized environments, contains a memory-safety bug in its OAuth2 filter that can crash worker processes when handling concurrent token exchanges. The vulnerability occurs when an asynchronous token-verification operation completes after the downstream connection it serves has already closed, causing the filter code to access memory that is no longer valid. An attacker can trigger this condition remotely without authentication, leading to denial of service. The issue does not enable code execution but degrades service availability.

• CVE-2026-53462MEDIUM 5.9

  ImageMagick, a widely-used open-source tool for image manipulation, contains a memory safety flaw that can crash applications processing certain malformed images. When the software attempts to allocate memory during image validation and that allocation fails, it may continue to use memory that has already been freed, leading to a denial of service. The issue affects ImageMagick versions prior to 6.9.13-50 (legacy branch) and 7.1.2-25 (current branch).

• CVE-2026-11941MEDIUM 5.6

  Cloudflare's Quiche QUIC library contains two use-after-free vulnerabilities in its C FFI (Foreign Function Interface) layer. When applications call the quiche_connection_id_iter_next or quiche_conn_retired_scid_next functions, these functions return a pointer to connection ID data that has already been freed from memory. This is a memory safety issue that primarily affects custom applications that directly use Quiche's C bindings—a relatively small subset compared to Rust consumers. The good news is the FFI layer is disabled by default and requires explicit build-time opt-in.

• CVE-2025-55644MEDIUM 5.5

  A memory safety flaw in GPAC MP4Box version 2.4 allows an attacker to crash the application by submitting a specially crafted MP4 video file. The vulnerability stems from improper handling of memory references in the scene graph processing code, where the application attempts to access memory that has already been freed. An attacker would need local access or the ability to trick a user into opening a malicious MP4 file.

• CVE-2025-55650MEDIUM 5.5

  CVE-2025-55650 is a memory safety flaw in GPAC MP4Box v2.4 that occurs when the application processes a specially crafted MP4 file. The vulnerability causes the program to access memory that has already been freed (a 'use-after-free' condition), leading to a crash or denial of service. An attacker would need to trick a user into opening a malicious MP4 file, but no special privileges are required to exploit it.

• CVE-2025-60471MEDIUM 5.5

  GPAC Project's MP4Box, a widely-used multimedia processing tool, contains a use-after-free memory flaw in its filter configuration logic. When processing a specially crafted media file, the vulnerable code attempts to access memory that has already been freed, causing the application to crash. An attacker can exploit this by distributing a malicious media file that, when opened by a user, brings down MP4Box. This is a denial-of-service vulnerability—it doesn't steal data or grant unauthorized access, but it can disrupt workflows that depend on MP4Box for media processing.

• CVE-2025-60486MEDIUM 5.5

  A memory safety flaw in GPAC's MP4Box tool allows an attacker to crash the application by processing a specially crafted MPEG-2 video file. The vulnerability stems from improper memory management in the dasher_process function—specifically, the code attempts to access memory that has already been freed. An attacker with local file access can exploit this by distributing a malicious video file that, when opened in MP4Box, triggers the defect and renders the tool unusable. This is a denial-of-service issue rather than a path to code execution or data theft.

• CVE-2026-44805MEDIUM 5.5

  A use-after-free vulnerability exists in Windows Network Controller Host Agent that allows a logged-in user to crash or hang the affected service, disrupting network configuration and management capabilities. The attacker must already have local user privileges on the system to exploit this flaw. While this is not currently known to be exploited in the wild, it represents a local denial-of-service risk that can render critical network infrastructure management unavailable.

• CVE-2026-47924MEDIUM 5.5

  Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a use-after-free memory flaw that could allow an attacker to read sensitive data from the application's memory. The vulnerability requires a user to open a crafted malicious PDF or document file, making this a low-friction attack that relies on social engineering rather than complex exploitation techniques. While memory disclosure alone does not enable direct system compromise, the leaked information could include credentials, encryption keys, or other confidential content.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-55510MEDIUM 5.5

  ImageMagick, a widely-used open-source image processing library, contains a use-after-free vulnerability triggered when the application processes a specially crafted 8BIM profile embedded in an image file. An attacker can exploit this by distributing a malicious image that, when opened or processed by ImageMagick, causes the application to crash or become unstable. The vulnerability affects versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-12298MEDIUM 5.4

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that allows an attacker to read or modify memory during user interaction with a malicious website or email. The flaw does not enable remote code execution or denial of service, but could leak sensitive information or corrupt application state. Mozilla has released patched versions to address this issue.

• CVE-2026-10232MEDIUM 5.3

  CVE-2026-10232 is a use-after-free vulnerability in Assimp, an open-source 3D model import library, affecting versions up to 6.0.4. The flaw exists in the ASE file parser component and can be triggered by a local attacker with user-level privileges when processing specially crafted ASE (ASCII Scene Export) files. Exploitation could allow an attacker to read sensitive data, modify application state, or crash the process. Because exploitation requires local access and user permissions, the risk is primarily relevant in multi-user systems or scenarios where untrusted ASE files are processed by privileged applications.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12329MEDIUM 5.3

  A memory safety defect affecting Mozilla Firefox and Thunderbird could allow an unauthenticated attacker to cause the application to crash or become unavailable. The vulnerability requires no user interaction and can be triggered remotely over a network. It does not enable data theft or system compromise, but denial-of-service impact is possible.

• CVE-2026-43704MEDIUM 5.3

  A memory management flaw in Apple's Safari browser and related operating systems could allow a malicious web extension to crash the browser or application unexpectedly. The vulnerability (CVE-2026-43704) stems from improper handling of memory after it has been freed, a class of bug that can be exploited by attackers who craft malicious extensions. Apple has patched the issue across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-56113MEDIUM 5.3

  dhcpcd, a widely-used DHCP client daemon, contains a memory safety bug that can be triggered by a malicious DHCPv6 server on the same network. An attacker who can send a specially crafted DHCPv6 renewal message can cause dhcpcd to crash. The vulnerability exists in how dhcpcd manages IPv6 address delegation—specifically when an attacker sets both lifetime values to zero in a prefix delegation exclusion option. Versions through 10.3.2 are affected; the fix is available in commit 5733d3c and later releases.

• CVE-2026-57436MEDIUM 5.3

  Nokogiri, a popular Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety bug in versions prior to 1.19.4. The vulnerability allows an attacker to set an invalid type of object (specifically a DTD node) as a document's root element, bypassing validation checks. This causes the library to crash or behave unpredictably when the invalid structure is processed during garbage collection. The issue is resolved in version 1.19.4 and later.

• CVE-2026-57437MEDIUM 5.3

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a memory safety issue in its XPath evaluation feature. If application code manually creates an XPathContext object and then allows the underlying XML/HTML document to be garbage collected while the context is still in use, subsequent XPath queries can read from freed memory, potentially crashing the application. This is a narrow vulnerability—it requires specific patterns in application code and cannot be triggered by feeding a malicious document to the library. The standard document search methods (Document#xpath, Document#css) are not affected.

• CVE-2025-60466MEDIUM 5.0

  GPAC MP4Box versions before 26.02.0 contain a memory safety flaw where freed memory can be accessed during packet filtering operations. An attacker who supplies a specially crafted media file can trigger a crash or service interruption. The vulnerability requires local access and user interaction (opening the file), limiting its direct remote exploitation potential but posing a risk in automated or batch processing environments.

• CVE-2026-11791MEDIUM 5.0

  A memory safety defect in 389 Directory Server can crash the service when an administrator reloads the schema while the server is handling active LDAP queries. The vulnerability stems from improper cleanup of attribute syntax data structures during schema reload, allowing worker threads to access memory that has already been freed. This condition results in a denial of service but does not enable data theft or modification.

• CVE-2026-50219MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when certain XML parsing functions (XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset) are called from within event handlers without proper depth tracking. This can lead to memory safety violations and potentially allow attackers to crash applications or, in some scenarios, execute arbitrary code. The vulnerability requires local access and specific conditions to trigger, making it a moderate-risk issue rather than a widespread internet-facing threat.

• CVE-2026-56131MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when the XML_ResumeParser function is called from within a handler and a policy violation is detected. In such cases, the library fails to properly track the call stack depth, leaving freed memory accessible and potentially exploitable. This is analogous to an earlier vulnerability (CVE-2026-50219) in the same codebase.

• CVE-2026-56412MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in its CDATA section handling. The issue stems from incomplete depth tracking when handlers are invoked during XML processing, allowing memory already freed by one operation to be accessed by another. This affects versions before 2.8.2. While the immediate trigger requires specific XML policy violations and local system access, the underlying condition can lead to crashes or potentially arbitrary code execution if an attacker controls the malicious XML input.

• CVE-2026-10634MEDIUM 4.8

  A race condition in Zephyr's TCP stack allows an attacker on the local network to crash the system or potentially read sensitive memory. The vulnerability exists in how the TCP layer iterates through active connections while a background thread can simultaneously free those connections, causing the iterator to access memory that has already been released. While the attacker needs local network access and user privileges to trigger the issue reliably, the outcome is denial of service or information disclosure on affected embedded and IoT devices running Zephyr.

• CVE-2026-10639MEDIUM 4.8

  Zephyr's IPv4 networking stack contains a use-after-free vulnerability in how it handles ping (ICMP echo) responses. When the device sends back a reply to an incoming ping, it processes the packet through the transmission path, which may immediately free the packet's memory. The code then attempts to read data from that freed memory to update network statistics, creating a window for reading corrupted or recycled data. An attacker can trigger this by sending repeated pings to a Zephyr device, potentially causing statistics corruption or a crash. The vulnerability requires specific configuration options to be enabled and the timing must align with the kernel's memory recycling, making exploitation probabilistic but feasible over a network without authentication.

• CVE-2026-11249MEDIUM 4.7

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the Network component. If an attacker compromises Chrome's renderer process—the sandboxed part that runs web content—they could read sensitive data from the browser's memory using a specially crafted HTML page. This is a memory safety issue: the code attempts to access data after it has already been freed, potentially exposing unencrypted information that was in use moments before.

• CVE-2026-56117MEDIUM 4.7

  dhcpcd, a widely deployed DHCP client daemon, contains a memory safety bug that can crash the service when privilege separation is disabled. A local user on the same system can exploit this by sending a specially crafted command to dhcpcd's control socket, causing the daemon to reference memory it has already freed. While the vulnerability requires local access and a specific configuration, it represents a denial-of-service risk in environments where dhcpcd runs with privilege separation turned off—a configuration sometimes found in embedded systems or minimal deployments.

• CVE-2026-11623MEDIUM 4.5

  A use-after-free memory vulnerability exists in tmux versions up to 3.6a, specifically within the image handling code. An attacker with local system access could trigger this flaw through a complex exploitation chain to read, modify, or crash tmux processes. While a public exploit has been disclosed, the attack requires both local access and deliberate manipulation, making opportunistic exploitation unlikely. The issue is resolved by upgrading to version 3.7-rc or applying the specific patch commit fc6d94a9f8a593bd8b7031650802084385d4ee03.

• CVE-2026-52757MEDIUM 4.4

  Ghidra, the National Security Agency's widely-used reverse-engineering and binary analysis platform, contains a memory safety bug in its decompiler. When a specially crafted binary file is opened in Ghidra's decompiler view, the application can access memory that has already been freed, potentially corrupting data or crashing the program. An attacker would need to distribute a malicious binary and convince a user to analyze it in Ghidra—the vulnerability itself does not allow remote code execution or network-based attacks.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-10636LOW 3.7

  Zephyr's IPv4 IGMP implementation contains a use-after-free vulnerability in its packet handling logic. After sending an IGMP message, the code attempts to read network interface information from a packet that may have already been freed and returned to memory pools by the network driver or stack. This can happen because the packet's last reference is released during transmission, but the code still tries to access it afterward. The issue is reachable by sending IGMP membership queries to the multicast address 224.0.0.1, or through local multicast operations, without requiring authentication. The practical result is typically unpredictable system behavior, potential crashes, or corruption of network statistics counters.

• CVE-2026-56373LOW 3.7

  ImageMagick versions before 7.1.2-15 have a memory handling defect in the PDB (Photoshop Document) decoder. When the decoder encounters memory allocation failures, it continues using a pointer that no longer points to valid memory. Attackers can craft malicious PDB files to trigger this condition, causing the application to crash or potentially write a single zero byte to freed memory regions.

• CVE-2026-56376LOW 3.7

  ImageMagick versions before 7.1.2-15 and 6.9.13-40 contain a memory safety flaw in the meta coder component. When processing certain crafted image files, the application may attempt to write data to memory that has already been freed, especially when internal memory allocation fails. An attacker can exploit this by sending specially designed images to trigger the flaw remotely, causing the ImageMagick process to crash and denying service to legitimate users.

• CVE-2026-14760LOW 3.3

  A use-after-free vulnerability has been discovered in radare2, a popular reverse-engineering framework. The flaw exists in the regprofile handler component and can be triggered by local attackers with low privileges, leading to an application crash or potential memory corruption. While a patch has been released, the vulnerability is not currently listed as exploited in the wild by known ransomware groups or government-backed actors.

• CVE-2026-14788LOW 3.3

  A use-after-free vulnerability exists in Radare2, a widely-used reverse engineering and binary analysis framework. The flaw is located in the binary loading function and can be triggered by a local attacker with basic user privileges. While the vulnerability has been publicly disclosed, its low severity rating reflects limited direct impact—the primary consequence is denial of service through application crash. Organizations using Radare2 in production or security workflows should apply the available patch, particularly if the tool processes untrusted binaries.

• CVE-2026-15194LOW 3.3

  Open5GS version 2.7.7 contains a use-after-free vulnerability in the AMF (Access and Mobility Management Function) component's context cleanup routine. An authenticated local attacker can trigger this flaw by manipulating the amf_context_final function, potentially leading to information disclosure. While the vulnerability requires local access and low privileges, public exploit code now exists, increasing practical risk despite the low CVSS rating.