CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

3.462 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2025-47379 Alta · 7.8 CWE-416 02/03/2026
Use After Free in Automotive Audio
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
CVE-2025-47377 Alta · 7.8 CWE-416 02/03/2026
Use After Free in Automotive Audio
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
CVE-2025-47376 Alta · 7.8 CWE-416 02/03/2026
Use After Free in Automotive Audio
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
CVE-2025-47375 Alta · 7.8 CWE-416 02/03/2026
Use After Free in Automotive Audio
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
CVE-2026-20443 Média · 6.7 CWE-416 02/03/2026
Use After Free em Google Android
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10436998; Issue ID: MSV-5722.
CVE-2026-20442 Média · 4.4 CWE-416 02/03/2026
Use After Free em Google Android
In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10436998; Issue ID: MSV-5723.
CVE-2026-20439 Média · 4.4 CWE-416 02/03/2026
Use After Free em Google Android
In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431955; Issue ID: MSV-5826.
CVE-2026-20437 Média · 4.4 CWE-416 02/03/2026
Use After Free em Google Android
In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431940; Issue ID: MSV-5843.
CVE-2026-27950 Alta · 7.5 CWE-416 25/02/2026
FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
CVE-2026-26986 Alta · 7.5 CWE-416 25/02/2026
FreeRDP has heap-use-after-free in rail_window_free
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
CVE-2026-25997 Crítica · 9.8 CWE-416 25/02/2026
FreeRDP has heap-use-after-free in xf_clipboard_format_equal
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
CVE-2026-25959 Crítica · 9.8 CWE-416 25/02/2026
FreeRDP: use-after-free no manuseio da área de transferência em xf_cliprdr_provide_data_
FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.23.0, `xf_cliprdr_provide_data_` passa `pDstData` já liberado para `XChangeProperty`, porque a thread do canal cliprdr chama `xf_cliprdr_server_format_data_response`, que converte e usa os dados da área de transferência sem manter nenhum lock, enquanto a thread de eventos do X11 chama concorrentemente `xf_cliprdr_clear_cached_data` → `HashTable_Clear`, que libera os mesmos dados via `xf_cached_data_free`, provocando um heap use after free. A versão 3.23.0 corrige o problema.
CVE-2026-25955 Crítica · 9.8 CWE-416 25/02/2026
FreeRDP: use-after-free no heap em xf_AppUpdateWindowFromSurface (XImage obsoleto)
FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.23.0, xf_AppUpdateWindowFromSurface reutiliza um XImage em cache cujo ponteiro data referencia um buffer de superfície RDPGFX já liberado, porque gdi_DeleteSurface libera surface->data sem invalidar appWindow->image, que aponta para o mesmo buffer. A versão 3.23.0 corrige o problema.
CVE-2026-25954 Alta · 7.5 CWE-416 25/02/2026
FreeRDP has heap-use-after-free in xf_rail_server_local_move_size
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
CVE-2026-25953 Crítica · 9.8 CWE-416 25/02/2026
FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
CVE-2026-25952 Crítica · 9.8 CWE-416 25/02/2026
FreeRDP: use-after-free em xf_SetWindowMinMaxInfo (CWE-416)
FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.23.0, xf_SetWindowMinMaxInfo desreferencia um ponteiro xfAppWindow já liberado, porque xf_rail_get_window em xf_rail_server_min_max_info retorna um ponteiro não protegido da tabela hash railWindows, e a thread principal pode excluir concorrentemente a janela (por meio de uma ordem de exclusão de janela) enquanto a thread do canal RAIL ainda usa o ponteiro. A versão 3.23.0 corrige o problema.
CVE-2026-2804 Média · 5.4 CWE-416 24/02/2026
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2799 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2798 Alta · 8.8 CWE-416 24/02/2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2797 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2795 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2789 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2787 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the DOM: Window and Location component
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2786 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2772 Crítica · 9.8 CWE-416 24/02/2026
Use-after-free in the Audio/Video: Playback component
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.