CWE-415 vulnerabilities

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-88812 is a high-severity double free vulnerability in the XKB SetGeometry function of the X.Org X Server and X Wayland. It affects versions of xorg-x11-server before 21.1.25 and X Wayland before 24.1.14. Exploitation could allow attached clients to cause a crash or potentially execute code within the X server context.

CVE-2026-94300 is a high-severity vulnerability in ISC BIND 9 that involves a double free memory corruption triggered by replaying GSS-TSIG signed UDP messages. An attacker capable of capturing a previously signed UDP message can replay it while the TSIG key remains valid. By sending crafted queries to a zone controlled by the attacker, remote code execution may be possible. This affects multiple BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26, including certain S1 variants.

CVE-2026-57446 is a double free vulnerability in the mz-automation libiec61850 library versions 1.6.1 up to but not including 1.6.2. The flaw occurs during the MMS ObtainFile operation where a file handle is closed but a stale non-NULL pointer remains. If a subsequent ObtainFile request reuses the task and destination creation fails, the stale file handle is closed again, leading to a server crash. This vulnerability affects servers with the MMS file service and ObtainFile enabled. The issue is fixed in version 1.6.2.

CVE-2026-94370 is a medium severity vulnerability in Qt for MCUs versions 2.12.1 and 2.12.2. It involves a double free condition caused by improper handling of string memory ownership when converting std::string text passed into Qt Quick Ultralite. This can lead to heap memory corruption including double free, invalid free, or use-after-free errors.

Adobe Photoshop Desktop contains a double free vulnerability (CWE-415) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.