Base de CVEs

CVE-2026-43497 Alta · 7.3 CWE-416 21/05/2026

fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation.

CVE-2026-45251 Alta · 7.8 CWE-416 21/05/2026

Kernel use-after-free via file descriptor syscalls

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability. The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges.

CVE-2026-9126 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9120 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9118 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9114 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)

CVE-2026-9112 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9111 Alta · 8.8 CWE-416 20/05/2026

Use After Free em Google Chrome

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-3593 Crítica · 9.8 CWE-416 20/05/2026

Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.

CVE-2026-33278 Crítica · 9.8 CWE-416 20/05/2026

Use-after-free no validador DNSSEC do NLnet Labs Unbound

O NLnet Labs Unbound de 1.19.1 até e incluindo a versão 1.25.0 possui uma vulnerabilidade no validador DNSSEC que permite negação de serviço e possível execução remota de código, como resultado da cópia profunda de uma estrutura de dados e da sobrescrita errônea de um ponteiro de destino. Um adversário pode explorar a vulnerabilidade controlando uma zona assinada maliciosa e consultando um Unbound vulnerável. Quando sub-consultas DS precisam suspender a validação devido à exaustão do orçamento computacional NSEC3 (introduzido no Unbound 1.19.1), o Unbound realiza cópia profunda de mensagens de resposta para preservá-las durante a liberação da região de memória. Um erro de atribuição de estrutura sobrescreve o ponteiro de destino com o ponteiro de origem. Após a região da sub-consulta ser liberada, o validador retomado desreferencia esse ponteiro pendente, provocando uma falha ou potencialmente permitindo execução arbitrária de código. O Unbound 1.25.1 contém um patch com correção para preservar o ponteiro correto ao copiar profundamente a estrutura de dados.

CVE-2026-8953 Crítica · 9.6 CWE-416 19/05/2026

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-8947 Alta · 7.3 CWE-416 19/05/2026

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-47310 Crítica · 9.8 CWE-416 19/05/2026

Use after free no Samsung Open Source Escargot (CWE-416)

Vulnerabilidade de use after free (uso de memória após liberação) no Samsung Open Source Escargot permite manipulação de ponteiros. Esta questão afeta o Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

CVE-2026-28733 Média · 6.5 CWE-416 19/05/2026

filemanagement_storage_service has an use after free vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

CVE-2026-8696 Crítica · 9.8 CWE-416 15/05/2026

Use-After-Free em gdbr_pids_list() no cliente GDB do radare2

radare2 6.1.5 contém uma vulnerabilidade de use-after-free na função gdbr_pids_list() dentro do núcleo do cliente GDB que permite que atacantes remotos causem negação de serviço ou potencialmente executem código arbitrário ao enviar respostas malformadas de informação de threads. Atacantes podem acionar a vulnerabilidade fazendo com que qsThreadInfo falhe após qfThreadInfo alocar com sucesso estruturas RDebugPid, resultando em corrupção de memória por double-free quando o caminho de erro tenta limpar a lista.

CVE-2026-8695 Crítica · 9.8 CWE-416 15/05/2026

Use-After-Free no radare2 em gdbr_threads_list()

O radare2 6.1.5 contém uma vulnerabilidade de use-after-free na função gdbr_threads_list() que permite a atacantes remotos provocar corrupção de memória ao enviar uma resposta qfThreadInfo válida seguida de uma resposta qsThreadInfo malformada. Atacantes podem explorar essa vulnerabilidade por meio da depuração remota GDB para causar negação de serviço ou, potencialmente, alcançar execução de código ao manipular o processamento da lista de threads.

CVE-2025-48521 Média · 6.9 CWE-416 14/05/2026

Use After Free em AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Renoir")

Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially resulting in a loss of platform integrity or crash.

CVE-2026-8587 Alta · 8.8 CWE-416 14/05/2026

Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker...

Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-8581 Alta · 8.8 CWE-416 14/05/2026

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to...

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-8580 Crítica · 9.6 CWE-416 14/05/2026

Google Chrome: use-after-free no Mojo com possível fuga de sandbox

Uso após liberação (use after free) em Mojo no Google Chrome anterior a 148.0.7778.168 permitia que um atacante remoto potencialmente realizasse uma fuga de sandbox por meio de uma página HTML criada para isso. (Severidade de segurança do Chromium: Média)

CVE-2026-8575 Alta · 8.3 CWE-416 14/05/2026

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had...

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-8574 Alta · 8.3 CWE-416 14/05/2026

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote...

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-8557 Alta · 7.5 CWE-416 14/05/2026

Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote...

Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8555 Alta · 8.8 CWE-416 14/05/2026

Use After Free em Google Chrome

Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8553 Baixa · 3.1 CWE-416 14/05/2026

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had...

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)