CVE Database

CVE-2026-57446 Medium · 5.3 CWE-415 Oct 16, 2026

libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

CVE-2026-110599 High · 7.1 CWE-415 Oct 14, 2026

L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

CVE-2026-94370 Medium · 6.5 CWE-415 Oct 14, 2026

Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

CVE-2026-95635 High · 7.8 CWE-415 Oct 13, 2026

Photoshop Desktop | Double Free (CWE-415)

Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-97830 High · 7.5 CWE-415 Oct 13, 2026

Windows Internet Information Services Denial of Service Vulnerability

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

CVE-2026-97812 High · 7.0 CWE-415 Oct 13, 2026

Windows Update Orchestrator Service Elevation of Privilege Vulnerability

Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

CVE-2026-97772 High · 8.8 CWE-415 Oct 13, 2026

Microsoft Office Excel Remote Code Execution Vulnerability

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-97767 High · 8.8 CWE-415 Oct 13, 2026

Microsoft Office Excel Remote Code Execution Vulnerability

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-97749 Critical · 9.8 CWE-415 Oct 13, 2026

Microsoft Office Outlook Remote Code Execution Vulnerability

Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

CVE-2026-96864 Critical · 9.8 CWE-415 Oct 13, 2026

Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability

Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.

CVE-2026-95943 High · 7.0 CWE-415 Oct 13, 2026

Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

CVE-2026-88171 High · 8.1 CWE-415 Oct 13, 2026

Windows DHCP Server Remote Code Execution Vulnerability

Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVE-2026-88149 High · 7.0 CWE-415 Oct 13, 2026

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-88071 High · 7.8 CWE-415 Oct 13, 2026

Windows Hyper-V Elevation of Privilege Vulnerability

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-85829 High · 7.8 CWE-415 Oct 13, 2026

Windows Wired AutoConfig Service Elevation of Privilege Vulnerability

Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.

CVE-2026-84012 High · 8.1 CWE-415 Oct 13, 2026

Windows Remote Desktop Services Remote Code Execution Vulnerability

Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

CVE-2026-83916 High · 7.0 CWE-415 Oct 13, 2026

Windows Error Reporting Remote Code Execution Vulnerability

Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

CVE-2026-83842 High · 7.0 CWE-415 Oct 13, 2026

Windows TCP/IP Elevation of Privilege Vulnerability

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVE-2026-83634 High · 7.8 CWE-415 Oct 13, 2026

Windows BitLocker Elevation of Privilege Vulnerability

Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVE-2026-70158 High · 8.8 CWE-415 Oct 13, 2026

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

CVE-2026-70062 High · 8.1 CWE-415 Oct 13, 2026

Windows libarchive Remote Code Execution Vulnerability

Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.

CVE-2026-108132 High · 7.0 CWE-415 Oct 13, 2026

Windows Kerberos Elevation of Privilege Vulnerability

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

CVE-2026-106175 Low · 2.3 CWE-415 Oct 13, 2026

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7,...

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.

CVE-2026-104192 Critical · 9.6 CWE-415 Oct 13, 2026

DragonflyDB stream RDB deserialization double-free

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

CVE-2026-109943 Medium · 6.5 CWE-415 Oct 13, 2026

FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.