CWE-416: Use After Free vulnerabilities

CVE-2026-63639 is a high-severity use-after-free vulnerability in the valkey distributed key-value database. It affects the RESTORE command prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The flaw arises when a malformed RDB stream payload assigns a single Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, leading to a use-after-free condition if one consumer is deleted while others still reference the shared NACK. This can potentially allow remote code execution. The issue is fixed in the specified patched versions.

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

A memory corruption vulnerability exists in Apple Safari when processing maliciously crafted web content. This issue could lead to memory corruption, potentially impacting confidentiality and integrity. The vulnerability is fixed in Safari 26.6.1 and corresponding updates for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The CVSS score is 5.4, indicating a medium severity level.

CVE-2026-49306 is a use-after-free (UAF) vulnerability in the time and time zone module of Huawei HarmonyOS version 6.1.0. Successful exploitation may impact system availability. The vulnerability has a low CVSS score of 3.3 and does not affect confidentiality or integrity. There is no information about an available patch or official remediation at this time.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of service attack.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.