CWE-415 vulnerabilities

Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-82325 is a use-after-free vulnerability in the OpenVPN ovpn-dco-win driver affecting versions 2.5.0 through 2.8.6. This flaw allows local authenticated users to cause a system crash by sending crafted control messages. The vulnerability has a medium severity rating with a CVSS score of 6.8. No public exploits are known, and no patch or vendor advisory information is provided regarding remediation.

CVE-2026-20510 is a double free vulnerability in the camera middleware of MediaTek chipsets. It can lead to local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset versions. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-84964 is a high-severity double free vulnerability in the MongoDB C Driver affecting versions 1.17.0 up to but not including 1.30.9, and 2.0.0 up to but not including 2.5.2. It occurs in the OpenSSL-based TLS certificate revocation checking path during the TLS handshake when specially crafted certificate data causes the same heap object to be freed twice. This can lead to unexpected termination of the client application. The vulnerability can be triggered by an unauthenticated party acting as a trusted TLS endpoint.

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

CVE-2026-75159 is a high-severity vulnerability in MongoDB BI Connector version 2.4.0. An unauthenticated client can cause the mongosqld process to terminate by triggering a double free error during a crafted Kerberos GSSAPI authentication exchange. This results in a denial of service by interrupting BI Connector availability until the process restarts.

CVE-2026-45202 is a medium severity vulnerability in Imagination Technologies Graphics DDK involving a double free condition. Non-privileged users can trigger GPU system calls that lead to GPU memory leaks and potential kernel heap corruption. The issue arises from improper handling of memory free paths that do not maintain state data for upgraded higher order allocations, causing double free or memory leak events.

CVE-2026-63652 is a double free vulnerability in FreeRDP versions prior to 3.28.0. The flaw occurs in the rdpsnd_server_recv_formats function when processing a malformed Client Audio Formats PDU, leading to a dangling pointer and a subsequent double free during session teardown. This can cause server termination and potential heap corruption. The issue is fixed in FreeRDP version 3.28.0.

Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

CVE-2026-66032 is a double-free vulnerability in libssh2 versions through 1.11.1 affecting the sftp_open() function. A malicious SSH server can exploit this flaw to corrupt the heap of an authenticated client during SFTP session initiation. The issue arises when the server's response triggers a double free of the same buffer pointer, leading to heap corruption and potential function pointer overwrites on glibc systems.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.