CWE-416: Use After Free vulnerabilities

CVE-2026-95834 is a use-after-free vulnerability in the drag and drop protocol implementation of the kitty terminal emulator versions 0.47.0 through before 0.49.0. It occurs because a pointer to freed heap memory is used after an error during drag and drop operations, leading to undefined behavior in the terminal process. The flaw arises from improper handling of error paths in drag_remote_file_data() and related functions, which free memory but allow continued use of dangling pointers.

IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF.

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.

Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.

Net::IDN::Punycode versions from 2.301 up to but not including 2.590 for Perl contain a heap use-after-free vulnerability in the XS backend's decode_punycode function. This flaw arises when decoding certain punycode labels with code points above U+FFFF, causing the output buffer to reallocate without updating all pointers, leading to use of freed memory. This vulnerability allows reading and writing of freed heap memory, potentially resulting in high impact on confidentiality, integrity, and availability.

CVE-2026-73512 is a use-after-free vulnerability in Envoy proxy's HttpDatagramHandler when HTTP/3 datagrams and Capsule Protocol are enabled. The issue occurs because the handler caches a pointer to a RequestDecoder that can be freed and replaced during stream recreation, such as an internal redirect, leading to a process crash. This vulnerability affects specific versions of Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, where the flaw has been fixed.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVE-2026-50572 is a use-after-free vulnerability in the Envoy proxy's HTTP external-authorization client. It occurs when a stale request callback is retained after a request rejection, leading to a process crash when the callback is invoked after its owner is destroyed. This issue affects specific versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 and is fixed in these versions.

CVE-2026-94084 is a critical use-after-free vulnerability in Suricata before version 8.0.7. It occurs in the Http2ThreadMultiBuf component when a transaction is inspected by rules that use http.response_header with and without a transform. This flaw can lead to high impact on confidentiality and integrity, with a lower impact on availability.

CVE-2026-88097 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows a local unauthorized attacker to elevate privileges. The flaw affects versions from 1.0.0.0 up to but not including 153.0.4234.46. Microsoft has released an official fix in version 153.0.4234.46. The vulnerability has a high severity rating with a CVSS score of 8.1.