CWE-415 vulnerabilities

Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.

Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.

Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

A double free vulnerability in NPU driver due to improper pointer management (940)

A double free vulnerability in NPU driver due to improper pointer management (941)

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.

CVE-2026-121507 is a double free vulnerability in the µD3TN BPv6 Fragmenter Block Duplication component. This flaw allows an unauthenticated remote attacker to cause a denial of service (DoS) by triggering allocation failure. The issue affects µD3TN versions prior to 0.15.2 and has been fixed in version 0.15.2.

CVE-2026-20582 is a double free vulnerability in the USB component of MediaTek chipsets. This memory corruption flaw can lead to local privilege escalation if an attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects specific MediaTek chipset versions including MT6993, MT8188, MT8189, MT8532, and MT8668. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-20573 is a double free vulnerability in the MediaTek chipset's afe component that can cause memory corruption. Exploitation does not require user interaction but requires the attacker to already have System privilege. Successful exploitation could lead to local escalation of privilege with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple MediaTek chipset versions including MT2735, MT2737, MT6768, and others. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-119338 is a medium severity vulnerability in the Tesseract OCR engine versions 5.4.0 up to but not including 5.5.4. The flaw involves an out-of-bounds read and double free/use-after-free conditions in the AppendLinePolygon function when processing right-to-left text such as Hebrew or Arabic. This leads to corrupted coordinate data being used internally. The issue is fixed in version 5.5.4.

CVE-2026-119116 is a high-severity use-after-free and double-free vulnerability in the SetClient command handler of the kmstool-enclave sample application within AWS aws-nitro-enclaves-sdk-c versions before 0.4.6. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. AWS has fixed this issue in version 0.4.6 of the SDK. Users should rebuild any enclave images that include kmstool-enclave or derived code against the fixed version to mitigate the risk.

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.