CWE-416: Use After Free vulnerabilities

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

CVE-2026-54898 is a use-after-free vulnerability in the Oj Ruby gem for JSON parsing, affecting versions prior to 3.17.2. The flaw occurs when a SAJ/SAJ2 callback mutates the input JSON string during parsing, causing the parser to hold a raw pointer to a string buffer that may be reallocated and freed. This issue is fixed in version 3.17.2.

CVE-2026-54897 is a heap use-after-free vulnerability in the Ruby oj gem (Optimized JSON) versions prior to 3.17.2. The flaw occurs when a Ruby block yields during iteration over Oj::Doc iterators and calls doc.close or d.close, which frees the document's heap memory while the C iterator remains active. This can lead to use-after-free conditions. The vulnerability has been fixed in versions 3.17.2 and 3.17.3.

### Summary Disabling `symbol_keys` on a reused `Oj::Parser` instance triggers a heap use-after-free. When `symbol_keys` is toggled from `true` to `false`, `opt_symbol_keys_set` frees the internal key cache (`cache_free`) but does not clear the pointer. The next `parse` call reads from the freed cache via `cache_intern`, producing a use-after-free. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/usual.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details `ext/oj/usual.c`, `opt_symbol_keys_set`: ```c // usual.c:1043–1051 if (symbol_keys) { d->key_cache = cache_create(...); // allocate } else { cache_free(d->key_cache); // free — but d->key_cache pointer not NULLed } ``` On the next parse call, `cache_key` → `cache_intern` reads from `d->key_cache` which now points to freed memory. ASAN report: ``` ==145265==ERROR: AddressSanitizer: heap-use-after-free on address 0x50b00001a318 READ of size 8 at 0x50b00001a318 thread T0 #0 cache_intern /ext/oj/cache.c:328 #1 cache_key /ext/oj/usual.c:161 #2 close_object /ext/oj/usual.c:285 #3 parse /ext/oj/parser.c:693 #4 parser_parse /ext/oj/parser.c:1408 freed by thread T0 here: #0 free #1 cache_free /ext/oj/cache.c:277 #2 opt_symbol_keys_set /ext/oj/usual.c:1051 #3 option /ext/oj/usual.c:1111 #4 parser_missing /ext/oj/parser.c:1362 0x50b00001a318 is 40 bytes inside freed 112-byte region [fd]fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' p = Oj::Parser.new(:usual, symbol_keys: true) p.symbol_keys = false # frees cache without nulling pointer p.parse('{"attacker":1}') # UAF: reads freed cache ```

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.