CWE-415 vulnerabilities

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-34867 is a double free vulnerability in the multi-mode input system of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation may impact system availability by causing a denial of service. The vulnerability has a medium severity with a CVSS score of 5.6. There is no information about an available patch or official remediation from the vendor. No known exploits are reported in the wild at this time.

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

Double free vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10363254; Issue ID: MSV-5617.

A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

CVE-2026-21918 is a high-severity double free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS running on SRX and MX Series devices. An unauthenticated attacker can trigger this flaw remotely by sending a specific sequence of TCP packets during session establishment, causing flowd to crash and the Flexible PIC Concentrator (FPC) to restart, resulting in a denial-of-service (DoS). This vulnerability affects multiple Junos OS versions prior to 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, and 24.2R2. Exploitation requires no authentication or user interaction and impacts availability without compromising confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using Juniper SRX or MX Series devices should prioritize patching to prevent potential service disruptions, especially in critical network infrastructure.

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.

Memory corruption occurs when a secure application is launched on a device with insufficient memory.

Memory Corruption when multiple threads concurrently access and modify shared resources.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149882; Issue ID: MSV-4673.