CWE-763
CVEs classified under CWE-763, newest first.
48 CVEsRSS
CVE-2026-112893High· 8.2PoCPillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale …
CVE-2026-68908Medium· 5.3PoClibIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the repo…
CVE-2026-97011High· 8.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-85850High· 7.8Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-85362High· 7.0Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-83908High· 7.0Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
CVE-2026-83889High· 8.8Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
CVE-2026-83735High· 7.8Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-108133High· 7.8Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-105405Medium· 5.9Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-100813High· 8.8⚖ disputedInvalid pointer in the JavaScript Engine: JIT component
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-98160Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_…
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_…
CVE-2026-98024Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc()
In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab …
CVE-2026-88340High· 7.6An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_…
CVE-2026-90387High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic co…
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic co…
CVE-2026-93045High· 7.8In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpf_arena_free_pages() accepts scalar arena addresses
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpf_arena_free_pages() accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a…
CVE-2026-80936High· 7.8⚖ disputedwifi: mt76: mt7925: cancel mlo_pm_work on stop
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo_pm_work on stop mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path…
CVE-2026-89500High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order …
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order …
CVE-2026-89498Medium· 5.5orangefs: fix double-free of trailer_buf on readdir copy failure
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when c…
CVE-2026-89502Medium· 5.5ring-buffer: Free cpu_buffer::free_page with subbuf_order
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. Use the c…
CVE-2026-77500High· 7.8Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-74860High· 8.5A flaw was found in libxml2 with Python bindings enabled
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This…
CVE-2026-16005Medium· 5.8Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (…
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (…
CVE-2026-80790Medium· 4.1kernel: nvmet-fc: fix invalid free in LS IOD error path (CVE-2026-80790)
A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could …
CVE-2026-19315NoneA type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
CVE-2026-74314High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes…
CVE-2026-68236High· 7.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the…
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the…
CVE-2026-64377High· 7.8In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_in…
CVE-2026-63986Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepar…
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepar…
CVE-2026-63809Medium· 6.4In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filt…
In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filt…