By weakness (CWE)

CWE-825: related vulnerabilities

CVEs classified under CWE-825. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

23 published vulnerabilities

• CVE-2026-12291HIGH 8.8

  CVE-2026-12291 is a use-after-free vulnerability in Firefox and Thunderbird's HTTP networking component. When a browser or email client processes certain HTTP interactions, freed memory can be incorrectly accessed, allowing an attacker to execute arbitrary code on the user's system. The vulnerability requires user interaction—such as clicking a malicious link or visiting a compromised website—but does not require any special system privileges. An attacker with network access can deliver the exploit to any user.

• CVE-2026-45447HIGH 8.8

  OpenSSL has a critical flaw in how it handles PKCS#7 and S/MIME signed messages. When these messages contain an empty digest algorithms field, OpenSSL incorrectly frees memory that the calling application still owns and expects to use later. This causes a use-after-free condition—essentially, the application tries to use memory that OpenSSL has already released. Depending on how the application manages that memory afterward, this can cause crashes, corruption of heap data, or in worse cases, allow an attacker to execute arbitrary code remotely. The vulnerability requires an authenticated user to send a specially crafted message, but once triggered, the damage can be severe.

• CVE-2026-46125HIGH 8.8

  CVE-2026-46125 is a memory safety bug in Linux kernel WiFi driver code that can cause system crashes or privilege escalation. When the kernel attempts to establish a multi-link WiFi connection and that setup fails, the code incorrectly retains station references that should have been cleaned up. This leaves dangling pointers in memory that can be exploited or cause the system to crash when the kernel debugfs interface tries to access them later. The vulnerability requires local network access and affects systems with WiFi enabled.

• CVE-2026-46166HIGH 8.8

  A memory safety flaw exists in the Linux kernel's Wi-Fi driver subsystem (mac80211). When the kernel performs radar detection checks on wireless channels, it can inadvertently access memory that has already been freed, potentially causing a system crash or enabling privilege escalation. The issue stems from unsafe iteration over a list of wireless channel contexts that can be modified during the operation.

• CVE-2026-52952HIGH 8.8

  A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) subsystem can cause a use-after-free condition when multiple devices in the same group undergo concurrent domain attachment operations during device recovery. The vulnerability arises from overly strict rejection of domain attachments while a device is resetting, which prevents necessary cleanup operations from completing and leaves dangling pointers to freed memory. A local attacker with sufficient privileges can exploit this to cause a kernel crash or potentially execute arbitrary code.

• CVE-2026-58592HIGH 8.3

  Ladybird, a web browser engine, has a memory-safety vulnerability in how it handles WebAssembly modules imported through the ESM (ECMAScript Modules) standard. When JavaScript code imports a WebAssembly function, the browser temporarily creates a function descriptor on the stack. If that descriptor is destroyed before the WebAssembly code finishes using it, the WebAssembly code ends up holding a reference to memory that's no longer valid. An attacker can exploit this stale reference to make the WebAssembly code write data to arbitrary memory locations, potentially achieving code execution within the browser's content process. The flaw requires user interaction (clicking or otherwise engaging with a malicious web page) to trigger, but no special browser features need to be enabled.

• CVE-2026-12326HIGH 8.1

  Firefox and Thunderbird version 151 contain memory safety defects that could allow an attacker to run arbitrary code on an affected system. Mozilla patched these issues in version 152. While exploitation requires significant effort and specific conditions, the risk is serious because successful attacks could grant complete control over the affected application and potentially the underlying system.

• CVE-2026-12328HIGH 8.1

  Multiple memory safety bugs have been identified in Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR across several recent versions. These flaws involve improper memory handling that could potentially allow attackers to execute arbitrary code on affected systems. The issues stem from memory corruption vulnerabilities that were discovered during Mozilla's routine security review. All affected versions have received security updates to remediate these issues.

• CVE-2026-46176HIGH 7.8

  A flaw in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem for Mellanox adapters causes improper error handling when initializing shared receive queues. When the second queue creation fails, the kernel incorrectly leaves freed memory pointers and error codes in place instead of properly backing out. This can lead to use-after-free conditions and memory corruption when subsequent operations attempt to access or clean up these corrupted pointers.

• CVE-2026-52923HIGH 7.8

  A memory safety bug in the Linux kernel's IPC (Inter-Process Communication) subsystem allows a local attacker with limited privileges to cause a denial of service or potentially leak sensitive information. The vulnerability exists in how the kernel allocates System V IPC identifiers during checkpoint/restore operations. When the valid ID space becomes full, the kernel can mistakenly allocate IDs beyond the legitimate range, creating orphaned memory references that may be accessed later through proc filesystem enumeration, leading to use-after-free conditions.

• CVE-2026-52950HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's DRM/XE DMA-buf subsystem. The flaw occurs when the kernel attempts to retry an operation after an error condition, but the underlying memory object has already been freed, causing the kernel to reference invalid memory. An attacker with local access and unprivileged user privileges could exploit this to crash the system or potentially execute arbitrary code with kernel-level permissions.

• CVE-2026-52973HIGH 7.8

  A vulnerability in the Linux kernel's futex (fast userspace mutex) subsystem can allow a local attacker with user privileges to corrupt memory and crash the system. The issue arises from overly restrictive checks in how the kernel allocates shared futex hash tables when processes clone and share memory. By exploiting how the kernel tracks futex references, an attacker can trigger use-after-free conditions that lead to kernel panics or potential privilege escalation. The fix loosens the clone detection logic to properly handle all memory-sharing scenarios, not just traditional pthreads.

• CVE-2026-52976HIGH 7.8

  CVE-2026-52976 is a use-after-free vulnerability in the Linux kernel's display and graphics subsystem (DRM/XE driver). The flaw exists in error handling code within the execution queue creation function. When certain resource allocation failures occur during queue setup, the kernel's cleanup logic fails to properly remove the queue from internal tracking structures before freeing memory. This leaves dangling pointers that can be dereferenced later, potentially allowing a local attacker with standard user privileges to corrupt kernel memory, escalate privileges, or crash the system.

• CVE-2026-53033HIGH 7.8

  A race condition exists in the Linux kernel's BPF sockmap implementation for Unix domain sockets. When a BPF iterator program updates a sockmap while a socket connection is closing, a stale pointer can be dereferenced, leading to a use-after-free memory error. An attacker with local access and unprivileged user privileges can exploit this by crafting a BPF program that interacts with sockmap operations concurrent with socket state transitions, potentially causing a kernel crash or memory corruption.

• CVE-2026-53085HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's BPF task_vma iterator. When BPF programs iterate through a task's virtual memory regions, the code reads the task's memory descriptor (mm_struct) without properly securing a reference to it. If the task exits while the iteration is happening, the memory descriptor can be freed, causing the BPF code to access freed memory. This affects systems running vulnerable kernel versions where unprivileged users or privileged BPF programs can trigger the flaw through specially crafted BPF programs that use open-coded task_vma iteration.

• CVE-2026-44422HIGH 7.5

  FreeRDP, a widely-used open-source Remote Desktop Protocol client, contains a memory corruption vulnerability in its authentication-redirection subsystem. A malicious RDP server can craft specially-formed authentication data that causes the FreeRDP client to allocate a single heap object but then attempt to free it twice—or use it after the first deallocation. This occurs because the parser doesn't properly track which heap objects correspond to which data structures when the same object reference is reused. The result is a crash or potential code execution on the client machine. The vulnerability requires user interaction (connecting to a malicious server) but affects all FreeRDP versions before 3.26.0.

• CVE-2026-57435HIGH 7.5

  Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety vulnerability in versions prior to 1.19.4. When an application modifies an XML attribute's value after the attribute node has been accessed by Ruby code, Nokogiri's native extension can inadvertently free memory that is still referenced elsewhere. This orphaned pointer can later cause the application to crash or behave unpredictably when the freed memory is accessed. The vulnerability requires no user interaction and can be triggered remotely if the affected code processes untrusted XML input.

• CVE-2026-6040HIGH 7.3

  CVE-2026-6040 is a memory safety vulnerability in ODF (Open Document Format) number format parsing. When a document contains a malformed number format with blank-width characters, a position value embedded in that format is not validated before being used to access the format-code string. This can cause the application to read from memory outside the intended buffer—a use-after-free condition. An attacker who crafts a malicious ODF document with a specially formed number format could trigger this flaw, potentially leading to information disclosure, data corruption, or application crash when the document is opened by a user.

• CVE-2026-46243HIGH 7.1

  A Linux kernel vulnerability allows unprivileged local users to manipulate CIFS (Common Internet File System) authentication credentials by creating spoofed credential requests. The vulnerability exists because the kernel's SMB client accepts cifs.spnego key descriptions that contain sensitive fields—like process ID, user ID, and credential UID—regardless of whether those fields come from the kernel itself or from untrusted userspace. An attacker with local access can forge these fields to impersonate legitimate credential requests, potentially gaining unauthorized access to network resources or intercepting authentication flows. The fix restricts acceptance of cifs.spnego keys only when they originate from the kernel's own credential handler.

• CVE-2026-42014MEDIUM 6.6

  GnuTLS, a widely-used cryptographic library, contains a use-after-free memory bug in its PIN management function. When an attacker attempts to change a Security Officer PIN on a hardware token that doesn't have protected authentication safeguards, the library incorrectly handles memory, potentially allowing local attackers to crash the service or manipulate sensitive cryptographic operations. This vulnerability requires local access and elevated privileges to exploit, making it primarily a risk in multi-tenant or shared-access environments.

• CVE-2026-12610MEDIUM 6.4

  SSSD, the System Security Services Daemon used across Linux systems for authentication, contains a use-after-free flaw in its PAM responder that can be triggered when users authenticate using YubiKey or smartcard devices. An attacker with local access can craft malicious smartcard contents to crash the authentication service, causing denial of service. While privilege escalation is theoretically possible through this vulnerability, exploitation for that purpose is difficult and would require additional complexity. The primary risk is disruption of authentication services rather than straightforward privilege gain.

• CVE-2026-46523MEDIUM 6.2

  ImageMagick, widely used image processing software, contains a memory safety defect that can be triggered when processing specially crafted MSL (Magick Scripting Language) image files. The vulnerability allows an attacker with local file access to cause the application to crash or potentially execute code by manipulating freed memory. This affects both the maintained 7.x branch and the legacy 6.x branch before specific patch versions.

• CVE-2026-54778MEDIUM 6.2

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a concurrency flaw in how it resolves user identities for Unix domain socket connections. The vulnerability stems from the use of non-thread-safe system functions (getpwuid and getgrgid) that can cause one client connection to be misidentified as another during simultaneous access, or potentially crash the service. Versions prior to 1.8.1 and 1.9.1 are affected. This is a local attack surface issue affecting systems where CoreWCF processes handle multiple concurrent Unix socket clients.