CWE-416: Use After Free vulnerabilities

A use-after-free vulnerability exists in GPAC 26.08-DEV in the function gf_node_deactivate_ex within the MP4Box component. This vulnerability requires local access to exploit and can cause a denial of service by crashing the application. The issue has been publicly disclosed but no active exploitation in the wild is reported. Upgrading to version abi-16.24 addresses this vulnerability.

A use-after-free vulnerability exists in the gpac 26.08-DEV version within the function gf_sg_command_del in the BIFS Handler component. This vulnerability requires local access to exploit and can cause a denial of service. A patch is available in version abi-16.24 that resolves this issue.

CVE-2026-92627 is a heap-use-after-free vulnerability in the HDF5 library before version 1.14.2. It occurs during the conversion of compound datatypes containing floating-point members when reading datasets. An attacker can craft a malicious HDF5 file that triggers this vulnerability, potentially causing application crashes or memory corruption. The vulnerability has a medium severity score of 4.6 and affects local attack vectors with low complexity and no privileges required but requires user interaction.

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVE-2026-19662 is a use-after-free vulnerability in ISC BIND 9 DNS resolver that can cause the service to abort. It occurs when multiple DNS queries for a DNSSEC-signed zone controlled by an attacker are sent, and the attacker responds with a crafted sequence of answers in a specific order and timing. This vulnerability affects several BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and their S1 variants. The CVSS score is 5.9, indicating medium severity, with impact limited to availability. There are no known exploits in the wild and no patch information is provided in the input data.

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.

CVE-2026-85893 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 153.0.4234.32. Microsoft has released an official fix in version 153.0.4234.32 to address this issue. The vulnerability has a high severity score of 8.8 and requires user interaction for exploitation.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash.

CVE-2026-70341 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an authorized attacker to execute code remotely over a network. The vulnerability affects versions prior to 152.0.4191.52 and has been assigned a high severity rating with a CVSS score of 8.5. An official fix is available in version 152.0.4191.52.

CVE-2026-45752 is a use-after-free vulnerability in Suricata versions 8.0.0 up to but not including 8.0.5. It occurs when certain detection transforms are chained, causing the decompress transform pipeline to read from a buffer after it has been freed. This flaw can cause Suricata to crash during network traffic processing if a malicious rule triggers it. Version 8.0.5 includes a fix for this issue. A temporary workaround is to avoid rules chaining 'gunzip' or 'zlib_deflate' with a max-size greater than 4096 after another transform.

CVE-2026-45751 is a use-after-free vulnerability in Suricata's inspection-buffer helper that affects versions prior to 7.0.16 and between 8.0.0 and 8.0.5. The issue occurs when a chained transform causes the backing buffer to be reallocated, leaving an inspection pointer referencing freed memory. This vulnerability requires a specific network traffic processing scenario and a particular but non-malicious rule involving the 'dotprefix' transform. Versions 7.0.16 and 8.0.5 include a fix for this issue. A workaround is to avoid chaining the 'dotprefix' transform after another transform.

CVE-2026-88032 is a high-severity use-after-free vulnerability in the reactive client-side encryption component of the MongoDB Java Driver. It occurs when native resources are freed while an encrypted operation is still using them if the operation is cancelled. Exploitation requires a reactive encryption setup that retrieves KMS credentials on demand. Successful exploitation can cause the hosting application process to terminate.

A use-after-free vulnerability exists in the cJSON library up to version 1.7.19 in the cJSONUtils_MergePatch function. This vulnerability can be exploited remotely and has a publicly available exploit. A fix has been proposed but is not yet accepted or officially released.

CVE-2026-21102 is a use-after-free vulnerability in the DualDAR component of Samsung Mobile Devices prior to the SMR September 2026 Release 1. This flaw allows local privileged attackers to execute arbitrary code with root privileges. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No affected versions or patch information are explicitly provided in the data.

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Acrobat contains a Use After Free vulnerability (CWE-416) that could allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction for exploitation and affects certain versions of Adobe Acrobat up to specified builds. The vulnerability has a high severity rating with a CVSS score of 7.8.

Adobe Acrobat contains a Use After Free vulnerability (CWE-416) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions up to 26.002.21900 and 24.001.30383. No known exploits are reported in the wild. The CVSS score is 7.8, indicating high severity.