CVE-2025-43529

CVE-2025-43529 TL; DR Appleは最近、iOS 26.2およびiPadOS 26.2をリリースし、WebKitの脆弱性に対する修正を含むセキュリティアドバイザリを公開しました。その中でもDFG JITコンパイラのバグ（CVE-2025-43529）が特に興味深かったため、調査することにしました。...

CVE-2024-2887-REPORT

SSD アドバイザリ – Google Chrome RCE 出典: ssd-disclosure.com/ssd-advisory-google-chrome-rce 概要 Google Chrome（バージョン123およびそれ以前）における、WebAssembly（WASM）のガベージコレクション型処理に影響する重大なリモートコード実行の脆弱性。このバグは型混乱を引き起こし、任意のメモリ読み取り/書き込み、最終的にはコード実行にエスカレーションされる可能性があります。 脆弱性の詳細 この脆弱性は、WASMの同型再帰的な正準型ID...

CVE-2024-44623

CVE-2024-44623 En SPX-GC 1.3.0v y versiones anteriores, la entrada controlada por el usuario se pasaba a la función exec del módulo childprocess sin ningún saneamiento, lo que conducía a una ejecución remota de código ciega no autenticada. Vulnerabilidad En /routes/routes-api.js, la entrada del...

CVE-2026-80958

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

EUVD-2026-76281

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-74936-gc-potato

CVE-2026-74936 一个并不精致的复现。基线部分需要一些调整。 Mozilla 将此问题描述为 WebAssembly 释放后使用（use-after-free）。公开修复 9823b5c86ffa 在 JitActivation 中保持精确捕获的 wasm::Code 存活。 该测试执行了一次错误签名的跨实例尾调用。当引擎处理陷阱时，一个 Debugger 展开钩子清除了表中最后一个目标引用，并强制进行收缩式 GC。在进入尾调用之前，Wasm 调用了一个打印标记的普通 JavaScript 导入。 结果 修复前父版本 9b564f641a42：状态 139（SIGSEGV）。...

PT-2026-90088

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache replay, the writeback worker and the GC worker bounds its length by PCACHE SEG SIZE - seg off, the raw segment size rather than the data...

A-potential-Denial-of-Service-issue-in-protobuf-java

A-potential-Denial-of-Service-issue-in-protobuf-java protobuf-java 中一个潜在的拒绝服务问题，高严重性，GitHub 已审阅，5 天前发布在 protocolbuffers/protobuf 中 • 昨天更新 漏洞详情 Dependabot 警报 2 软件包 com.google.protobuf:protobuf-java maven 受影响版本 = 3.18.0, = 3.19.0, = 3.18.0, = 3.19.0, 3.19.2 已修补版本 3.18.2 3.19.2 软件包 google-protobuf...

CVE-2025-49844

CVE-2025-49844 – Redis Lua 解析器释放后使用 Lua chunk 名称的 GC 竞争条件导致 Redis 8.2.1 释放后使用及远程代码执行。 概述 Redis 内嵌 Lua 5.1 用于脚本执行。在 8.2.1 及之前的版本中，luaYparser 函数在调用词法分析器之前，并未将 chunk 名称字符串锚定在 Lua 栈上。恶意构造的脚本可在解析器仍引用已释放字符串时触发垃圾回收，从而产生释放后使用（UAF），导致原生代码执行。 环境 Redis 服务器 8.2.1（或 8.2.2 之前任意受影响版本） redis-cli 可本地网络访问 Redis 实例...

CVE-2026-84118-who-labeled-the-crit-as-a-high

CVE-2026-84118 — SpiderMonkey GC 释放后使用（Bug 2057457） 这是 Mozilla 将严重级别为 Critical 的问题标记为 High 的案例之一。如果确实如此，也许有人应该去让 Firefox 更新对原始漏洞发现者的奖励。 简而言之：你可以对一个受控指针执行越界（OOB）读原语，然后从该指针开始上下移动。因此，如果你将受控指针指向一个数组，那么恭喜你，你可以做很多有趣的事情。 该 PoC 仅包含 SEGV 部分，其余部分则是一次有趣的冒险——指向数组内部并跳转到你选择的 WASM。 针对 Firefox/SpiderMonkey 154.0...

uaf-2023-28205

CVE-2023-28205：Apple WebKit 释放后使用漏洞 该漏洞影响 Apple WebKit，可通过恶意构造的 Web 内容加以利用，并有可能在 WebKit 进程上下文中执行任意代码。 本仓库中所分析的受影响 WebKit 构建基于 WebKit-613.1.17.1 （PlayStation / Safari 15.4 系列）。 描述 该概念验证通过在结构化克隆操作期间有意延迟注册 Map 和 Date 等 JavaScript 对象，从而触发释放后使用（UAF）条件。 这一时间窗口使 JavaScriptCore 垃圾回收器（GC）...

AZL-99510 CVE-2026-80807 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

EUVD-2026-71242

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80807

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80807 nilfs2: reject invalid block index in GC ioctl

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80807

CVE-2026-80807 affects the nilfs2 filesystem in the Linux kernel . The root cause is a missing range check on vd_offset and vd_vblocknr fields in the nilfs_vdesc structure during the garbage-collection (GC) ioctl. An attacker or fuzzer can supply artificially crafted parameters that cause a page/...

Linux Distros Unpatched Vulnerability : CVE-2026-80807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within...

SUSE CVE-2026-74746

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

SUSE CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

Linux Distros Unpatched Vulnerability : CVE-2026-84118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...