Threats Tagged 'ghsa-mqcv-532f-gp47'

CVE-2026-84894 is a use-after-free vulnerability in Meta Platforms, Inc's moxygen component. The issue occurs before commit 004123dd24c3, where MoQSession::dataStreamReadLoop continues to use a stream read handle after receiving a FIN signal, which invalidates the handle under proxygen's WebTransport API. A remote attacker can trigger this by opening a data stream with an unknown track alias and sending the FIN in the same write. This vulnerability has a high severity with a CVSS score of 7.5 and impacts confidentiality but not integrity or availability.