CWE-415
CVEs classified under CWE-415, newest first.
205 CVEsRSS
CVE-2026-88149High· 7.0Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-88071High· 7.8Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-85936High· 8.8Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
CVE-2026-85904High· 7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85829High· 7.8Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
CVE-2026-84012High· 8.1Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2026-83916High· 7.0Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
CVE-2026-83842High· 7.0Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-83634High· 7.8Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
CVE-2026-70158High· 8.8Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVE-2026-70062High· 8.1Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
CVE-2026-108132High· 7.0Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVE-2026-106175Low· 2.3A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, Fo…
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, Fo…
CVE-2026-104192Critical· 9.6Dragonfly is an in-memory data store built for modern application workloads
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL,…
CVE-2026-109943Medium· 6.5PoCFreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser clean…
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser clean…
CVE-2026-109271Low· 3.7ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory all…
CVE-2026-109257Medium· 5.9PoCFreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a la…
CVE-2026-95702High· 8.5Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backi…
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backi…
CVE-2026-108104Medium· 4.8Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declar…
CVE-2026-104113Medium· 5.4A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmt…
CVE-2026-5759Critical· 9.8A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis repl…
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis repl…
CVE-2026-107886Low· 2.3PoCOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validat…
CVE-2026-107209Medium· 5.9ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause…
CVE-2026-20532Medium· 6.2In apu, there is a possible application crash due to double free
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue I…
CVE-2026-47558High· 7.8NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution,…
CVE-2026-89078Critical· 9.9GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on…
CVE-2026-6794High· 7.8IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
CVE-2026-91018High· 8.8lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
CVE-2026-11388Medium· 6.9Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.
CVE-2026-17050Medium· 5.7The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c)
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a fai…