CVE-2026-119332 is a use-after-free vulnerability in LadybirdBrowser's JavaScript engine, specifically in the FinalizationRegistry cleanup process. An attacker-controlled JavaScript callback can trigger freeing of memory that is still accessed later, leading to memory corruption. This flaw can cause crashes and potentially allow code execution. The vulnerability has a high severity score of 8.8 and has been fixed in a specific commit.
CVE-2026-119116 is a high-severity use-after-free and double-free vulnerability in the SetClient command handler of the kmstool-enclave sample application within AWS aws-nitro-enclaves-sdk-c versions before 0.4.6. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. AWS has fixed this issue in version 0.4.6 of the SDK. Users should rebuild any enclave images that include kmstool-enclave or derived code against the fixed version to mitigate the risk.
CVE-2026-65586 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It involves improper GPU system calls by non-privileged software that can free memory still in use and replace it with another allocation. This leads to arbitrary memory reads or writes to physical memory pages by the GPU, potentially causing high impact on integrity and availability.
CVE-2026-15466 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It arises from a race condition in the destruction path of hardware performance counters buffer, where non-atomic decrement of a reference counter allows use of freed kernel heap memory. This vulnerability can be triggered by software running as a non-privileged user through improper GPU system calls.
CVE-2026-93516 is a use-after-free vulnerability in X.org X Server and XWayland related to improper lifecycle management of XInput master devices. It affects versions of X.org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients can exploit this flaw to crash the X server or potentially execute code within the X server context. The vulnerability has a medium severity with a CVSS score of 5.5. Fixes are available in the specified versions.
CVE-2026-93515 is a use-after-free vulnerability in the present_clear_window_notifies() function of the X.org X Server and X Wayland. It affects versions prior to 21.1.25 for X.org X Server and prior to 24.1.14 for X Wayland. This flaw allows malicious X clients with limited privileges to crash the X server or potentially execute code within the server context. The vulnerability has a medium severity with a CVSS score of 6.8. Fixed versions 21.1.25 and 24.1.14 address this issue.
CVE-2026-57187 is a heap-use-after-free vulnerability in Asterisk's PJSIP TCP/SDP handling. It affects multiple versions prior to fixed releases and requires an authenticated attacker to send a SIP INVITE over a connection-oriented transport and disconnect before a 200 OK response. The issue has been detected using Address Sanitizer, a development tool not used in production. Fixed versions are available.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
CVE-2026-95620 is a use-after-free vulnerability in the Qt Network module's QNetworkAccessManager HTTP/2 client support. This flaw allows a malicious or compromised HTTP/2 server to cause the client application to crash, impacting availability. The vulnerability affects Qt versions from 6.9.0 up to but not including 6.11.3. A fix is available starting with version 6.11.3. The CVSS 4.0 base score is 2.1, indicating a low severity impact.
Apache Traffic Server versions 10.0.0 through 10.1.4 and 10.2.0 contain a use-after-free vulnerability in the experimental wasm plugin's transaction-close handler. This flaw also involves forwarding unvalidated guest-supplied metric IDs to the internal stats API. The issue is resolved in versions 10.1.5 and 10.2.1.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message.
Root Cause:
When processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::AppendAndDestroySelf -> RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the stream object is freed while still in use, resulting in a use-after-free. Additionally, deleting the chunk stream discarded its previous message header, so subsequent compressed (type-3) chunk headers on that stream could no longer be decoded.
Affected Scenarios:
Any application using the bRPC RTMP protocol implementation (rtmp policy), either as an RTMP server or as an RTMP client, where the remote endpoint is untrusted. The attacker needs to send an Abort message targeting a chunk stream id that is concurrently used for sending, which can crash the process or lead to memory corruption.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3515
CVE-2026-74758 is a heap use-after-free vulnerability in the RTMP protocol component of Apache bRPC versions prior to 1.18.0. A remote attacker can crash a bRPC RTMP server by sending a specially crafted Abort control message without requiring authentication. The flaw occurs because the server deletes a chunk stream object while it is still being accessed, leading to use-after-free.
NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC (DoQ) implementation. This flaw occurs during multi-threaded operation when a client-triggered QUIC path migration causes cleanup of a DoQ stream while a mesh reply still holds a pointer to it. The subsequent dereference of the freed pointer leads to a crash. The issue is fixed in version 1.26.2.