CVE-2025-60458

CVE-2025-60458 UxPlay 1.72 RTSP TEARDOWN 双重释放漏洞 描述 UxPlay 1.72 版本在其 RTSP 请求处理逻辑中存在一个双重释放漏洞。远程攻击者可以通过发送特制的 RTSP TEARDOWN 请求，触发对同一堆内存对象的多次 free 调用。 该缺陷源于 RTSP 会话清理过程中不当的内存生命周期管理。触发该漏洞会导致堆破坏，进而引发拒绝服务（应用程序崩溃）。 漏洞类型 双重释放 受影响产品 UxPlay 1.72 版本 受影响组件 RTSP 请求处理 / 会话拆除逻辑 攻击向量 远程 通过网络发送特制的 RTSP 请求即可触发 影响 拒绝...

kernel: smb: client: fix double-free in SMB2_open() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...

kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: smb: client: fix query directory replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

leHACK-Analysis-of-CVE-2018-8453

leHACK 2019：分析 CVE-2018-8453：Windows 内核中 UAF 与双重释放的有趣故事 本演讲于 leHACK 2019 上发表 摘要 在本次演讲中，我们讨论了 CVE-2018-8453 的利用细节。这是 Microsoft Windows 驱动程序 win32.sys 中的一个漏洞，由卡巴斯基实验室报告，因为它被用于高度定向的攻击。 在本次演讲中，我们讨论其复杂细节、如何复现该漏洞，以及如何在不同版本的 Windows 上利用该漏洞，因为易受攻击的代码同样存在于 Windows 7、8.1 和 10 中（不过我们将仅演示 Windows 7 和 Windows...

Linux Distros Unpatched Vulnerability : CVE-2026-89974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error,...

Linux Distros Unpatched Vulnerability : CVE-2026-89870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: zoran: Avoid freeing a registered videodevice twice zoraninitvideodevice installs zoranvdevrelease as the videodevice release callback through...

Linux Distros Unpatched Vulnerability : CVE-2026-89887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freei...

Linux Distros Unpatched Vulnerability : CVE-2026-89895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree...

cve-2024-1086-writeup

CVE-2024-1086 根本原因与利用 目标内核： Linux 6.8（netfilter nftables） 新颖角度： nftverdictinit 中的逻辑混淆导致引用计数 double-free，可通过堆喷射实现任意内存写入。 目录 1. 背景 — netfilter / nftables 概述 2. 根本原因分析 — nftverdictinit 逻辑混淆 3. 受影响的内核代码 — 带注释的源码节选 4. 概念验证 — 触发和利用代码 5. 利用策略 — 堆喷射实现任意写入 6. 参考资料...

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 双重释放 影响: Apache HTTP Server 2.4.66 搭配 modhttp2 + Event MPM 修复版本: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 高 — 可能实现未认证的远程代码执行 CWE: CWE-415 双重释放 漏洞描述 Apache 2.4.66 中的 modhttp2 在 h2mplx.c:mstreamcleanup 函数中存在一个双重释放漏洞。当客户端在同一流上先发送 HEADERS 帧紧接着发送 RSTSTREAM...

CVE-2026-91960

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the StreamEnsureRemainingCapacity function, leading to an integer wraparound and a...

RLSA-2026:67165 Important: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUI...

DEBIAN-CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-82677

A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the moduleTimerHandler function within the Module Timer subsystem src/module.c. This flaw could lead to a denial of service. Mitigation Restrict access to high-privilege administrative users capab...

EUVD-2026-78636

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960 FreeRDP before 3.31.0 Integer Overflow Double Free

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length, triggering integer wraparound that leads to a double free and crashes the FreeR...