CVE-2026-41216 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::ExecuteInformation function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported.
CVE-2026-42057 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::vtkPNGReaderUpdate2 function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported. There is no indication of public exploits or active exploitation in the wild. No patch information is provided in the available data.
CVE-2026-53918 is a use-after-free vulnerability in the odhcpd DHCPv6 handler used by OpenWrt. It affects versions prior to 25.12 and involves a dangling pointer when processing multiple IA options in a DHCPv6 message, leading to a heap-use-after-free read. This can cause unauthenticated denial of service and confusion of DHCPv6 Reconfigure/ForceRenew keys. The issue has been patched in version 25.12.
A use-after-free vulnerability exists in GCC's libstdc++ library when the erase_if function is called on a binary heap priority queue. This flaw causes the library to reallocate storage without updating its internal entry pointer, potentially leading to application crashes or memory corruption. The vulnerability can be exploited to cause denial of service. Red Hat has issued a security advisory with updated packages to address this issue.
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage, resulting in a use-after-scope crash and denial of service. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::read_native_scanlines(), task_set, ok, compressed_scratch, and uncompress_one_strip(), which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
CVE-2026-76891 is a medium severity vulnerability in Wireshark that causes a crash in the sharkd component due to expired pointer dereference. It affects Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. The issue leads to a denial of service condition but does not impact confidentiality or integrity.
CVE-2026-76890 is a medium severity vulnerability in Wireshark that causes a crash in the sharkd component due to expired pointer dereference. It affects versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. The issue results in a denial of service but does not impact confidentiality or integrity.
In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invoke the k_pipe_init syscall to re-initialize a pipe that is already in use.
z_impl_k_pipe_init() unconditionally resets the ring buffer, sets pipe->waiting to 0, and re-initializes both wait queues (z_waitq_init on pipe->data and pipe->space) without waking or accounting for threads currently blocked on the pipe. Any thread already pended in k_pipe_read()/k_pipe_write() is left orphaned: still marked pending with pended_on pointing at the cleared wait queue and with stale qnode_dlist links into the (now re-initialized) embedded list head.
When such an orphaned waiter is later timed out or woken, the scheduler calls sys_dlist_remove() on its stale node, writing through dangling prev/next pointers into kernel wait-queue/scheduler structures, causing list corruption (an attacker-driven invalid kernel write), lost wakeups, indefinitely blocked threads, and silent data loss. The flaw lets a deprivileged user thread corrupt the state of a kernel object shared with other threads/partitions.
The fix switches the verifier to K_SYSCALL_OBJ_NEVER_INIT(), matching the existing k_msgq_init verifier, so a user thread can no longer re-initialize a live pipe. The vulnerable code shipped in v4.1.0 and remained through v4.4.0.
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
A use-after-free vulnerability exists in the gnutls_pkcs11_token_set_pin function of GnuTLS, which is triggered when changing the Security Officer PIN with a NULL old PIN on tokens lacking a protected authentication path. This flaw can lead to memory corruption and potential denial of service. The vulnerability is rated as medium severity with a CVSS score of 6.6. Red Hat has released a security update addressing this issue in their Extended Life Cycle Support 7 packages.
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.
The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.
Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
CVE-2026-32873 is a high-severity vulnerability in the Gleam web server 'ewe' versions 0.8.0 through 3.0.4. The flaw exists in the handle_trailers function, where rejected trailer headers cause an infinite recursion loop, leading to 100% CPU usage and a denial-of-service condition. This occurs because the function repeatedly re-parses the same header without advancing, permanently wedging the BEAM process. Exploitation requires no authentication or user interaction and can be triggered remotely via chunked HTTP requests. The vulnerability is fixed in version 3.0.
CVE-2026-30978 is a high-severity use-after-free vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccCmm::AddXform() function, where a heap-use-after-free leads to invalid virtual pointer dereference and application crash. Exploitation requires local access and user interaction but no privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. The issue is fixed in version 2.
A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability