CWE-415 vulnerabilities

Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.

The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (buf->ref++, if (--buf->ref > 0), if (--(*ref_count))). The API is documented as self-synchronizing: callers may share one buffer across threads (e.g. via k_fifo) and each holder independently calls net_buf_unref() with no surrounding lock. Under true concurrency (SMP, or single-core preemption between the non-atomic load and store while another context unrefs the same buffer), two holders can both observe the same prior reference value and both conclude they are the last reference. For heap/variable-data pools (mem_pool_data_unref/heap_data_unref, used by zbus message subscribers, the IP stack RX/TX buffers when CONFIG_NET_BUF_FIXED_DATA_SIZE=n, capture, wireguard, ISO-TP and usbip) this produces a double k_heap_free()/k_free() of the same block -- heap-metadata corruption and a use-after-free on the heap-hardening poison pattern. For the per-header refcount the buffer is returned to the pool free LIFO twice for any pool type (including fixed-data pools used by Bluetooth and networking), corrupting the free list so a later allocation hands the same buffer to two owners. The fix converts both refcounts to atomic_inc/atomic_dec (overlaying buf->ref in an atomic_t-sized union and changing the data-block refcount from uint8_t to atomic_t). Impact is gated on genuine concurrency and on an application architecture that shares one buffer among multiple independent unref'ers; the trigger is a refcount/timing race rather than packet content, so an external attacker has at most weak indirect influence over the race window. Affects all Zephyr releases through v4.4.0. This fix is not being backported to v3.7-branch (LTS). The backport was attempted and closed unmerged (#111181): the v3.7 networking tree has diverged from main, and the new atomic word-packing -- together with the assertions it adds -- turns pre-existing v3.7-only reference-counting defects elsewhere in the stack into hard faults, so landing the change faithfully would mean pulling an open-ended set of additional v3.7-only fixes into an LTS branch. v3.7 remains affected. Applications on v3.7 that share one net_buf across threads should serialize their own net_buf_unref() calls rather than rely on the documented self-synchronizing behaviour. The fix is on main and has been backported to v4.3-branch (#110852) and v4.4-branch (#110853).

A double free vulnerability exists in libarchive's RAR5 reader that can cause applications using the library to crash, resulting in denial of service. This occurs when the filtered_buf pointer is freed twice during the processing of specially crafted RAR5 archives. The issue affects multiple specific versions of libarchive as used in various Ubuntu and Red Hat Hardened Images packages. A security update is available from Red Hat that addresses this vulnerability.

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

CVE-2026-12043 is a high-severity vulnerability in the AWS Common Runtime aws-c-http library involving improper handling of HPACK dynamic table size updates. This flaw allows a remote server to cause memory corruption on a client application by sending a crafted sequence of HTTP/2 HEADERS frames, potentially leading to arbitrary code execution. The issue affects aws-c-http versions from 0.4.22 through 0.10.15 inclusive. A fix is available in version 0.11.0.

CVE-2026-46690 is a medium severity vulnerability in the spearman unbounded-spsc queue library versions 0.2.0 and earlier. It involves an out-of-bounds read caused by a pointer-as-value transmute operation in the sender::send function, which can lead to a fake-Arc drop during concurrent transmit/receive races. No patches or official fixes are available at the time of publication.

CVE-2026-45324 is a low-severity vulnerability in the rizin reverse engineering framework caused by a double free error in the byte_pattern_search function due to incorrect pointer ownership. This flaw can lead to a denial of service by crashing the application. The issue is fixed in commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. No known exploits are reported in the wild. The vulnerability affects versions of rizin prior to this commit.

Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.