CWE-415 vulnerabilities

Double free in Windows Shell allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.

Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

CVE-2026-109943 is a high-severity double free vulnerability in FreeRDP versions 3.29.0 before 3.32.0. It occurs in the client's async-update message proxy when handling polygon points arrays with zero points, leading to a double free during cleanup. A malicious RDP server can exploit this by sending crafted polygon orders to crash the client if async-update is enabled.

A use-after-free vulnerability exists in ImageMagick versions 7.1.2-30 before 7.1.2-32 in the WBINFO decoder. This occurs when a memory allocation fails during image decoding, allowing an attacker to supply a crafted image that triggers reuse of freed memory and crashes the application.

FreeRDP versions before 3.32.0 have a double-free vulnerability in the nsc_context_initialize_encode() function. This flaw occurs when a partial buffer growth failure leaves dangling plane pointers, which can be triggered by a crafted RDP client negotiating NSCodec with a large desktop geometry. Exploitation causes the server to crash during context teardown.

CVE-2026-95702 is a use-after-free vulnerability in the virtual file system (VFS) component of Google gVisor prior to release 20260831.0. It allows a local attacker with standard container privileges to execute code in the host sentry process by triggering a double-free of the backing MemoryFile in an in-sandbox overlay filesystem. The sentry process remains confined by Linux seccomp and namespace boundaries on the host.

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.

In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168.

CVE-2026-47558 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It involves a double-free flaw in the kernel mode layer that can be triggered by an unprivileged user. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-89078 is a critical double free vulnerability in GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. It allows an authenticated user to execute arbitrary code on the GitLab server by exploiting a flaw in parsing specially crafted regular expressions in CI/CD configurations. The issue has been fixed in versions 19.2.7, 19.3.3, and 19.4.1.

IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.

CVE-2026-91018 is a high-severity double free vulnerability in the lwIP API affecting versions from 2.0.1 through 2.2.1. This flaw can lead to system crashes, denial of service, memory corruption, or potentially remote code execution without user interaction or privileges. The vulnerability has a CVSS 3.1 score of 8.8, indicating a significant risk if exploited. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

CVE-2026-11388 is a double free vulnerability in RTI Connext Professional Core Libraries that allows file manipulation. It affects versions from 7.4.0 up to but not including 7.7.0.1, and from 7.1.0 up to but not including 7.3.1.6. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No known exploits in the wild or vendor patches are currently documented.

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.