CWE-416: Use After Free vulnerabilities

CVE-2026-108465 is a use-after-free vulnerability in the Windows Update Delivery Optimization component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability is classified as high severity with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-108464 is a use-after-free vulnerability in the Software Protection Platform (SPP) component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A patch addressing this issue is officially available from Microsoft.

CVE-2026-108461 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting multiple builds of Microsoft Windows 10 Version 1809 and later. An authorized local attacker could exploit this flaw to elevate privileges on the affected system. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-105722 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting Microsoft Windows 10 Version 1809 and later builds up to specific patched versions. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-108458 is a high-severity use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-105715 is an integer overflow or wraparound vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 7.5 and affects multiple versions prior to specific fixed releases. Official patches have been released by Microsoft to address this issue.

CVE-2026-108468 is a use-after-free vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and other versions. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7. An official fix is available and has been released by Microsoft.

CVE-2026-105725 is a use-after-free vulnerability in the Microsoft Windows Security App that allows an authorized local attacker to elevate privileges. The flaw affects versions prior to 1000.27840.1000.0 and has been assigned a high severity rating with a CVSS score of 7. An official fix is available from Microsoft.

Adobe FrameMaker 2026 contains a Use After Free vulnerability (CWE-416) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 base score is 7.8, indicating high severity.

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.

A use-after-free vulnerability exists in KeePassXC prior to version 2.8.0-beta1. This occurs when importing KeePass1/KDB legacy files with crafted metastream entries, leading to a stale pointer dereference in the parseCustomIcons4() function. The flaw can cause a heap use-after-free with a controlled write and a reliable process crash. The issue is fixed in version 2.8.0-beta1.

FreeRDP versions from 3.0.0-beta1 up to but not including 3.32.0 contain a use-after-free vulnerability in the smartcard handling component. This flaw allows attackers to trigger an invalid smartcard connect operation that reuses a freed smartcard handle object, potentially causing memory corruption or application crashes.

CVE-2026-85965 is a use-after-free vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. The flaw exists in the JavaScript engine integration and can lead to memory corruption, controlled process failure, or server instability. The vulnerability has a high severity with a CVSS score of 8. No known exploits are currently reported in the wild. The affected versions are explicitly stated, and the vulnerability has been publicly disclosed.

A use after free vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the PDF writer component when handling CMYK images with JPEG2000 compression. This flaw can cause the process to crash when processing specially crafted images.

FreeRDP versions 2.1.0 before 3.32.0 have a use-after-free vulnerability in the static rdpsnd channel disconnect path. This flaw occurs because audio formats and device memory are freed without properly synchronizing with the play_thread. A malicious RDP server can exploit this by disconnecting during asynchronous Wave2 playback, causing the client to access freed heap memory and crash.

CVE-2026-21120 is a use-after-free vulnerability in the WSM service of Samsung Mobile Devices prior to the SMR October 2026 Release 1. This flaw allows local attackers to potentially execute arbitrary code with system privileges. The vulnerability has a high severity score of 8.9 according to CVSS 4.0. No specific affected versions or patch information is provided.

A use-after-free vulnerability exists in GPAC up to version 26.07.0 in the gf_fq_pop function of the MP4Box component. This vulnerability can be triggered remotely and may lead to limited confidentiality, integrity, and availability impacts. Exploit code is publicly available. The vendor has not responded to disclosure attempts and no patch information is provided.

CVE-2026-95702 is a use-after-free vulnerability in the virtual file system (VFS) component of Google gVisor prior to release 20260831.0. It allows a local attacker with standard container privileges to execute code in the host sentry process by triggering a double-free of the backing MemoryFile in an in-sandbox overlay filesystem. The sentry process remains confined by Linux seccomp and namespace boundaries on the host.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

Memory corruption while processing service requests.