CWE-416: Use After Free vulnerabilities

Memory Corruption when executing system service routines due to improper handling of user input buffers.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.

CVE-2026-20542 is a use-after-free vulnerability in the apusys component of MediaTek chipsets. This memory corruption flaw can lead to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset versions are affected. The vulnerability has a medium severity rating with a CVSS score of 6.7.

CVE-2026-20537 is a use-after-free vulnerability in the aidl component of MediaTek chipsets. It can cause memory corruption leading to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset models.

CVE-2026-20536 is a use-after-free vulnerability in the aidl component of MediaTek chipsets. It can cause memory corruption and potentially lead to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset models are affected.

CVE-2026-20531 is a use-after-free vulnerability in the MediaTek chipset's apu component that can cause memory corruption. This flaw allows local attackers to escalate privileges without requiring additional execution privileges or user interaction. The vulnerability affects specific MediaTek chipset models. A patch has been identified by MediaTek under Patch ID ALPS11249016.

CVE-2026-73637 is a use-after-free vulnerability in the mod_auth_digest module of Apache HTTP Server versions 2.4.0 through 2.4.68. It allows an unauthenticated remote attacker to cause authentication state corruption via concurrent Digest authentication requests when specific configuration options are enabled. The issue is fixed in Apache HTTP Server version 2.4.69.

CVE-2026-57941 is a critical Use After Free vulnerability in Apache HTTP Server's mod_http2 module affecting versions from 2.4.0 through 2.4.68. The flaw involves re-entrancy issues with the shared session->bbtmp, potentially allowing an attacker to execute arbitrary code or cause denial of service.

CVE-2026-56154 is a critical Use After Free vulnerability in Apache HTTP Server's mod_rewrite module when using lookahead expressions (%{LA-U:HTTP:...}). It affects versions from 2.4.0 through 2.4.68. The flaw allows remote attackers to cause a high-impact compromise including full confidentiality, integrity, and availability loss.

iperf3 version 3.21 contains a critical remote, unauthenticated heap use-after-free vulnerability. The issue arises because the server's per-test watchdog function frees streams without properly cancelling or joining their associated worker threads, leading to a use-after-free condition when a blocked worker thread dereferences a freed iperf_stream. This vulnerability is fixed in version 3.22.

CVE-2026-47598 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver for Linux, specifically within the open-source kernel module's event delivery path. This flaw allows an unprivileged local user to trigger a race condition between asynchronous event delivery and file close. Exploitation could lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patch information are provided.

CVE-2026-47597 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver's open-source kernel module Resource Server for Windows and Linux. It allows an unprivileged local user to cause memory corruption due to a missing self-reference guard during map cleanup. The vulnerability has a high severity with a CVSS score of 7.8 and can potentially lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. No affected versions or patch information are provided in the available data.

CVE-2026-47589 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It can be triggered by an unprivileged user through a specific sequence of driver commands. Exploitation may lead to code execution, privilege escalation, denial of service, and information disclosure. The vulnerability has a high severity with a CVSS score of 7.8. No patch or remediation information is currently available.

CVE-2026-47588 is a use-after-free vulnerability in the NVIDIA GPU Display Driver for Linux affecting RTX, Quadro, and NVS products. An unprivileged user can trigger this flaw by issuing a sequence of driver commands. Successful exploitation could lead to code execution, privilege escalation, denial of service, and information disclosure. The vulnerability has a high severity score of 7.8. No specific affected versions or patch information is provided.