CWE-416: Use After Free vulnerabilities

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-69244 is a high severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.3 contain an out-of-bounds heap read in the C response parser during error message construction for malformed HTTP responses. This flaw can be triggered by a malicious or accidental server response, potentially causing a denial of service (DoS) in the client. The issue is fixed in version 3.14.3.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.

CVE-2026-67300 is a client-side use-after-free vulnerability in FreeRDP versions before 3.29.0. It occurs in the asynchronous update message proxy handling RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. A malicious or compromised RDP server can send crafted update orders that cause the client to use freed memory, potentially leading to memory corruption or a crash.

CVE-2026-63035 is a heap use-after-free vulnerability in the TransferSubscriptions service of the open62541 product by o6 Automation. It may allow an authenticated attacker to cause denial of service or potentially execute arbitrary code. The vulnerability affects versions 1.3.0, 1.4.0, and 1.5.0. The CVSS score is 8.1, indicating high severity. No official patch or remediation guidance is currently available.

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend.

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

CVE-2026-13071 is a high-severity use-after-free vulnerability in MongoDB Server that allows an authenticated user with read access to cause the mongod process to terminate. This occurs through certain aggregation expressions that execute server-side JavaScript, due to improper memory handling during document processing. The vulnerability affects specific MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance is currently provided by the vendor.

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.

A use-after-free vulnerability was found in libssh where data callbacks may be invoked after the associated data has been freed if data packets are processed after a channel is closed. This can lead to crashes or potential use-after-free conditions affecting availability.

CVE-2026-16362 is a use-after-free vulnerability in the WebRTC Audio/Video component affecting Firefox and Thunderbird. This flaw was addressed in Firefox 153 and Thunderbird 140.13. Exploitation could lead to high impact consequences. No known exploits are reported in the wild.

CVE-2026-16353 is a critical security vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component of Mozilla Firefox and Thunderbird. This flaw was addressed and fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability could lead to memory corruption issues. No known exploits in the wild have been reported. The fix is officially available from Mozilla as part of their security advisories.

CVE-2026-60080 is a Use After Free vulnerability in the Rust deserialization logic of Apache Fory affecting versions from 0.13.0 through 1.3.0. A crafted payload can trigger undefined behavior, potentially causing process crashes or memory disclosure. The issue is fixed in version 1.4.0.