Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

CVEs (9,769)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-26311 1Envoyproxy 1Envoy Jun 17, 2026 Mar 10, 2026 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution...Show more Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method. The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData. FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.Show less
CVE-2026-27277 1Adobe 1Substance 3d Stager Aug 28, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in...Show more Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Show less
CVE-2026-27276 1Adobe 1Substance 3d Stager Aug 28, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in...Show more Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Show less
CVE-2026-3847 1Mozilla 1Firefox Jun 17, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabil...Show more Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148.0.2.Show less
CVE-2026-30978 1Color 1Iccdev Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulner...Show more iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulnerability is fixed in 2.3.1.5.Show less
CVE-2026-26134 1Microsoft 2365 Copilot Office Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVE-2026-26132 1Microsoft 9Windows 10 21h2 Windows 10 22h2Windows 11 23h2+6 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-26107 1Microsoft 5365 Apps ExcelOffice+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-25189 1Microsoft 5Windows 10 1809 Windows 10 21h2Windows 10 22h2+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-25178 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-25171 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2026-25170 1Microsoft 7Windows 11 23h2 Windows 11 24h2Windows 11 25h2+4 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-25167 1Microsoft 4Windows 11 24h2 Windows 11 25h2Windows 11 26h1+1 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.4 HIGH· v3 N/A· v2 Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.
CVE-2026-24295 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-24292 1Microsoft 11Windows 10 1809 Windows 10 21h2Windows 10 22h2+8 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-24289 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 19, 2026 Mar 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-24285 1Microsoft 15365 Copilot OfficeWindows 10 1607+12 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-23671 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-23669 1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 more Jun 17, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Use after free in RPC Runtime allows an authorized attacker to execute code over a network.
CVE-2026-23667 1Microsoft 7Windows 10 1809 Windows 10 21h2Windows 10 22h2+4 more Jun 17, 2026 Mar 10, 2026 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.

Previous 1...156157158...489 Next