CWE-416
CVEs classified under CWE-416, newest first.
2351 CVEsRSS
CVE-2026-108333Low· 2.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-57187High· 7.1Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `P…
CVE-2026-82388Medium· 5.3Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). Tha…
CVE-2026-116540Medium· 5.9netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTi…
CVE-2026-79979High· 7.8Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the …
CVE-2026-53918High· 8.8odhcpd DHCPv6 IA dangling first pointer use-after-free
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure …
CVE-2026-95620Low· 2.1Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
CVE-2026-111804High· 8.2Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0…
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
CVE-2026-74758NoneApache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is re…
CVE-2026-84727Medium· 5.4Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processi…
CVE-2026-97206High· 7.5PoCDNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connectio…
CVE-2026-114042Medium· 6.5PoCFreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well…
CVE-2026-114111High· 8.9Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a craft…
CVE-2026-112396Medium· 5.9Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
CVE-2026-112402High· 7.5PoCPillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-92388NoneFTP wildcard write callback mixup
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle…
CVE-2026-113271High· 8.8Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-113101High· 8.8Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113058High· 8.8Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113119High· 8.8chromium-browser: chromium-browser: Arbitrary code execution via crafted HTML page (CVE-2026-113119)
A flaw was found in chromium-browser. A use-after-free memory corruption issue in the Network component allows a remote attacker to execute arbitrary code within the browser sandbox. To exploit this vulnerability, an attacker must trick a …
CVE-2026-113097High· 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113339High· 8.8Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113161High· 8.8chromium-browser: chromium-browser: Use after free in WebRTC (CVE-2026-113161)
An use after free flaw was found in the WebRTC component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=568945639 https://code.google.com/p/chromium/issues/detail?id=113161
CVE-2026-113092High· 8.8Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113298High· 8.8Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113253High· 8.8Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113163High· 8.8Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)