CWE-416: Use After Free vulnerabilities

CVE-2026-20515 is a use-after-free vulnerability in the GPU component of MediaTek chipsets MT6991 and MT8799. Exploitation requires local user privileges and user interaction, potentially leading to local information disclosure without system crash or integrity impact. The vulnerability has a medium severity rating with a CVSS score of 5.0.

CVE-2026-20511 is a use-after-free vulnerability in the SurfaceFlinger component of MediaTek chipsets. It can cause memory corruption and potentially allow local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects specific MediaTek chipset models MT6858, MT6881, MT6993, and MT8668. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-20507 is a use-after-free vulnerability in the Audio HAL component of MediaTek chipsets. It allows local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset models. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-20506 is a use-after-free vulnerability in the Audio HAL component of MediaTek chipsets. It allows local escalation of privilege if the attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset models. The CVSS score is 6.7, indicating a medium severity level.

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.

CVE-2026-82623 is a use-after-free vulnerability in the open62541 library versions 1.5.0 through 1.5.5. The flaw is located in the UA_DataValue_backend_copyRange function of the History Backend component. It can be exploited remotely without authentication. The vulnerability has a CVSS score of 5.3, indicating medium severity. Exploit code is publicly available, but the project has not officially disclosed the vulnerability through its issue tracker. No patch or official fix information is provided.

CVE-2026-66798 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code over a network. The flaw affects versions prior to 152.0.4191.52 and 152.0.4191.53. An official fix has been released to address this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A use-after-free vulnerability exists in the TLS-enabled WebSocket client of the cpp-httplib C++ library versions 0.33.0 through 0.50.0. The issue occurs because the TLS session is freed before the WebSocket close operation completes, leading to use of freed memory. This defect is triggered during normal teardown of a secure WebSocket connection. The vulnerability is fixed in version 0.50.1.

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A use-after-free vulnerability exists in AcademySoftwareFoundation's openexr library in versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. This flaw allows a crafted EXR image with a nonzero dataWindow.min to cause TypedFlatImageChannel::row() to return an invalid heap pointer, leading to out-of-bounds or use-after-free writes when applications write rows via FlatHalfChannel::row(). The issue affects tools and services processing untrusted EXR files. Fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVE-2026-77235 is a use-after-free vulnerability in FreeRTOS-Kernel versions before 11.3.1. It arises from missing privilege verification in the secure context cleanup handler, potentially allowing local users to cause a use-after-free condition in secure-world memory via the SVC handler. This vulnerability has a high severity rating with a CVSS score of 7.3. Users should upgrade to FreeRTOS-Kernel version 11.3.1 or later to remediate the issue.

CVE-2026-17118 is a critical use-after-free vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-63380 is a use-after-free vulnerability in libevent prior to version 2.2.2-alpha. It occurs in the WebSocket session handling code when an error path is taken after a successful WebSocket start but a locking operation fails. This leads to an invalid list pointer dereference and potential process crash. The issue is fixed in libevent version 2.2.2-alpha.

CVE-2026-18299 is a use-after-free vulnerability in the GStreamer multimedia framework's rtpsbcdepay component. It allows remote attackers to execute arbitrary code by exploiting improper validation of RTP payload elements. The flaw arises from operations on objects without verifying their existence, leading to potential remote code execution in the context of the affected process.

CVE-2026-76957 is a use-after-free vulnerability in libexpat that affects versions prior to 2.8.4. The issue occurs due to missing handler call depth tracking when using custom encoding callbacks, which can cause premature freeing of memory and subsequent access. The vulnerability has a medium severity rating with a CVSS score of 4.9.

A use-after-free vulnerability exists in the CMS protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause the application to crash, resulting in a denial of service condition. The issue has a medium severity rating with a CVSS score of 5.5. No information about available patches or exploits in the wild is provided.

CVE-2026-16851 is a use-after-free vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. It has a CVSS v3.1 score of 7.4, indicating a high severity level.

CVE-2026-58083 is a use-after-free vulnerability in the FreeBSD kernel related to the handling of knotes during the fork operation. A timer-based knote could be enqueued twice due to a race condition and improper locking, leading to corruption of the kqueue's active list. This flaw allows an unprivileged local user to trigger a kernel use-after-free, potentially resulting in privilege escalation.

CVE-2026-49418 is a use-after-free vulnerability in FreeBSD affecting specific releases. It occurs when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, leading to corruption of the pager's page list and double freeing of pages upon object destruction. An unprivileged local user with access to a device providing memory-mapped I/O can trigger this flaw, potentially allowing privilege escalation.