CWE-415 vulnerabilities

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the Samsung Exynos DPU driver (due to improper pointer management during DMA buffer reallocation) leads to kernel memory corruption and a potential use-after-free.

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.

CVE-2026-61915 is a medium severity double-free vulnerability in Cyrus IMAP before version 3.12.4. It occurs when an authenticated calendar user sends a PATCH request with a specific PATCH-ACTION parameter to a resource containing multiple properties of the same kind, causing the Cyrus CalDAV worker to crash due to memory being freed multiple times.

Adobe Acrobat contains a double free vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction to be exploited. The issue affects multiple versions of Adobe Acrobat up to 26.002.21900 and 24.001.30383. The vulnerability has a high severity rating with a CVSS score of 7.8.

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.

Double free in Windows Hello allows an authorized attacker to elevate privileges locally.

Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.

Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.

Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.

Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network.