Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-17591
Low · 3.6
CWE-416 Oct 16, 2026
Libarchive: libarchive: use-after-free via aliased mac metadata copy
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
CVE-2026-110753
Unknown
CWE-416 Oct 16, 2026
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
CVE-2026-85748
Critical · 9.9
CWE-416 Oct 16, 2026
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-110922
High · 8.8
CWE-416 Oct 15, 2026
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-110921
High · 8.8
CWE-416 Oct 15, 2026
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute...
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110919
High · 8.8
CWE-416 Oct 15, 2026
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute...
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110915
High · 8.8
CWE-416 Oct 15, 2026
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker...
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-108446
High · 8.8
CWE-416 Oct 15, 2026
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-108442
High · 8.8
CWE-416 Oct 15, 2026
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108438
Medium · 6.5
CWE-416 Oct 15, 2026
Microsoft Office Word Information Disclosure Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-86567
High · 8.8
CWE-416 Oct 14, 2026
Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-102078
Medium · 5.9
CWE-416 Oct 14, 2026
Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.
This issue affects Junos OS on SRX Series:
* All versions before 23.2R2-S5;
* from 23.4 before 23.4R2-S6;
* from 24.2 before 24.2R2-S3;
* from 24.4 before 24.4R2-S1;
* from 25.2 before 25.2R1-S1, 25.2R2.
CVE-2026-101970
Medium · 6.5
CWE-416 Oct 14, 2026
Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
CVE-2026-97205
High · 8.1
Public exploit CWE-416 Oct 14, 2026
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-84471
High · 7.2
CWE-416 Oct 14, 2026
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2...
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
CVE-2026-92392
High · 8.1
Public exploit CWE-416 Oct 14, 2026
HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
CVE-2026-50217
Medium · 4.7
CWE-416 Oct 14, 2026
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform...
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.
CVE-2026-50215
Medium · 4.4
CWE-416 Oct 14, 2026
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore...
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL, resulting in an immediate system crash.
CVE-2026-94453
High · 7.5
CWE-416 Oct 13, 2026
IKEv2 Use-After-Free bug when using IKE-over-TCP
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
CVE-2026-110172
High · 8.8
CWE-416 Oct 13, 2026
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110171
High · 8.8
CWE-416 Oct 13, 2026
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110170
Medium · 4.3
CWE-416 Oct 13, 2026
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110169
High · 8.8
CWE-416 Oct 13, 2026
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute...
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110168
High · 8.8
CWE-416 Oct 13, 2026
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute...
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110167
High · 8.8
CWE-416 Oct 13, 2026
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)