PT-2026-111438

Use-after-free in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5...

PT-2026-111434

Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5...

PT-2026-111445

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5...

PT-2026-112985

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network...

PT-2026-111918

Name of the Vulnerable Software and Affected Versions Windows Win32 Kernel Subsystem affected versions not specified Description A use-after-free condition in the Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issu...

PT-2026-111921

Name of the Vulnerable Software and Affected Versions Windows Virtualization-Based Security VBS Enclave affected versions not specified Description A use-after-free condition in the Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...

PT-2026-111879

Name of the Vulnerable Software and Affected Versions Windows Update Service affected versions not specified Description A use-after-free condition in the Windows Update Service allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs wh...

Microsoft Office: CVE-2026-88178: Microsoft Office PowerPoint Remote Code Execution Vulnerability

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network...

UBUNTU-CVE-2026-98385

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...

PT-2026-111666

Name of the Vulnerable Software and Affected Versions xen versions prior to 4.22.0 06-1.1 Description A race condition occurs during grant table operations when transitioning between v1 and v2. Specifically, a sequence of v2 to v1 and then back to v2 changes can cause status pages to be freed and...

Microsoft Windows: CVE-2026-83762: Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70067: Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2026-68138

CVE-2026-68138 — Linux kernel net/sched qdisc rate-table UAF tracking site Source for the CVE-2026-68138 patch-status tracker: a single-page site recording which distributions have shipped a fix for the net/sched qdisc rate-table use-after-free / double-free in the Linux kernel. Where the facts...

CVE-2018-6574

CVE-2018-6574...

CVE-2019-2215

CVE-2019-2215 CVE-2019-2215 — Android Binder Use-After-Free Privilege Escalation Description Exploit for vulnerability CVE-2019-2215 — use-after-free in the Android kernel binder driver. Allows privilege escalation to root on vulnerable devices. Vulnerability CVE-2019-2215 — use-after-free in...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

EUVD-2026-98095

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938

The Bluetooth host stack is vulnerable to a use-after-free and memory corruption in the ATT transmit path. Specifically, in subsys/bluetooth/host/att.c, the BT_ATT_OP_SIGNED_WRITE_CMD branch incorrectly calls net_buf_unref(buf) when bt_smp_sign() fails. This violates the established contract wher...

CVE-2024-1065

CVE-2024-1065 — Page Cache Exploitation PoC Proof-of-concept exploit for CVE-2024-1065, a physical page use-after-free in the ARM Mali GPU kernel driver. The exploit demonstrates page cache exploitation : racing a freed MIGRATEMOVABLE page into the in-memory code image of a SUID binary, then...