Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

CVEs (9,769)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-25997 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 9.8 CRITICAL· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr chan...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.Show less
CVE-2026-25959 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 9.8 CRITICAL· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_serve...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls `xf_cliprdr_clear_cached_data` → `HashTable_Clear` which frees the same data via `xf_cached_data_free`, triggering a heap use after free. Version 3.23.0 fixes the issue.Show less
CVE-2026-25955 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 9.8 CRITICAL· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `g...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `surface->data` without invalidating the `appWindow->image` that aliases it. Version 3.23.0 fixes the issue.Show less
CVE-2026-25954 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 7.5 HIGH· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected po...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.Show less
CVE-2026-25953 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 9.8 CRITICAL· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.Show less
CVE-2026-25952 1Freerdp 1Freerdp Jun 17, 2026 Feb 25, 2026 5.5 MEDIUM· v4 9.8 CRITICAL· v3 N/A· v2 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info`...Show more FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.Show less
CVE-2026-2804 1Mozilla 2Firefox Thunderbird Jun 17, 2026 Feb 24, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2799 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2798 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2797 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2795 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2789 1Mozilla 2Firefox Thunderbird Jun 17, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2787 1Mozilla 2Firefox Thunderbird Jun 17, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2786 1Mozilla 2Firefox Thunderbird Jun 17, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2772 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2770 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2769 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2767 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2766 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2765 1Mozilla 2Firefox Thunderbird Jul 15, 2026 Feb 24, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Previous 1...158159160...489 Next