CVE-2019-11932

CVE-2019-11932 How a double-free bug in WhatsApp turns to RCE I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

drmemory

Dr. Memory: the memory debugger About Dr. Memory Dr. Memory is a memory monitoring tool capable of identifying memory-related programming errors such as accesses of uninitialized memory, accesses to unaddressable memory including outside of allocated heap units and heap underflow and overflow,...

CVE-2023-25136

CVE-2023-25136 OpenSSH 9.1 vulnerability mass scan and exploit Description OpenSSH server sshd 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default...

linux-kernel-exploits

linux-kernel-exploits Introduction linux-kernel-exploits Vulnerability List CVE Description Kernels CVE–2018–18955 mapwrite in kernel/usernamespace.c allows privilege escalation Linux kernel 4.15.x through 4.19.x before 4.19.2 CVE–2018–1000001 glibc glibc 2.6.22 released in 2007 CVE-2016-2384 a...

launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

redis-poc

Redis Authenticated RCE stream NACK double free, TDigest & TopK module bugs Non-destructive RCE exploits for Redis 6.2.22, 7.4.9, 8.6.4 via the stream consumer-group shared-NACK double free a patch bypass of CVE-2026-25243, 8.8.0 via a TDigest heap-overflow in bundled RedisBloom, and 8.8.1 via a...

CVE-2026-110599

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

CVE-2023-25136

OpenSSH Pre-Auth Double Free CVE-2023-25136 POC This repository contains a Proof of Concept POC script to check for the OpenSSH Pre-Auth Double Free vulnerability CVE-2023-25136 using the Paramiko library in Python. Prerequisites Before running this POC script, you need to make sure you have the...

jfrog-CVE-2023-25136-OpenSSH_Double-Free

CVE-2023-25136 Proof-of-Concept Overview This is a DoS Proof-of-Concept of OpenSSH 9.1p1 Double-Free Vulnerability CVE-2023-25136. It will trigger the double-free and cause an abort crash. For a comprehensive understanding, check out the accompanying blog post for in-depth details. Dependencies...

CVE-2026-110599 L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

CVE-2026-110599

L-SMASH versions through 2.14.5 are vulnerable to a double free vulnerability within the hevc_setup_first_summary() and h264_setup_first_summary() functions located in importer/nalu_imp.c. The root cause is the improper freeing of borrowed codec-specific objects during error paths. An attacker ca...

EUVD-2026-101227

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

CVE-2026-94370

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking...

CVE-2026-94370 Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking...

CVE-2026-94370 Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking...

EUVD-2026-100839

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking...

CVE-2026-94370

A defect in the Qt for MCUs core string handling leads to heap memory corruption. When an application provides text to Qt Quick Ultralite via the Qul::String interface while using std::string, the system copies the pointer without taking ownership. This results in two objects releasing the same m...