983 matches found
CVE-2026-118026
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: GC component...
CVE-2026-118007
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are provided as a courtesy,...
CVE-2024-2887-REPORT
SSD Advisory – Google Chrome RCE Source: ssd-disclosure.com/ssd-advisory-google-chrome-rce Summary A critical remote code execution vulnerability in Google Chrome versions 123 and earlier affecting WebAssembly WASM garbage-collection type handling. The bug allows type confusion that can be...
CVE-2025-43529
CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...
CVE-2026-84118-who-labeled-the-crit-as-a-high
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 This is one of those where Mozilla labeled a Critical as a High. So someone might want to go have Firefox update the original bug hunters payment if that's the case. THE TLDR: You can do an OOB R primitive on a controlled pointer and the...
uaf-2023-28205
CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability affects Apple WebKit and can be exploited through maliciously crafted web content, potentially allowing arbitrary code execution in the context of the WebKit process. The affected WebKit build analyzed in this repository...
CVE-2024-44623
CVE-2024-44623 In SPX-GC 1.3.0v and below versions, user-controlled input was passed in the exec function of the childprocess module without any sanitization, leading to unauthenticated blind remote code execution. Vulnerability In /routes/routes-api.js, user input received from file param and...
CLEANSTART-2024-VT68685 Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers
CVE-2021-43539 affects multiple packages. Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. See references for individual vulnerability details...
CVE-2025-49844
CVE-2025-49844 – Redis Lua Parser Use-After-Free Lua chunk-name GC race leading to Redis 8.2.1 use-after-free and remote code execution. Overview Redis embeds Lua 5.1 for scripting. In versions up to 8.2.1 the luaYparser function does NOT anchor the chunk name string on the Lua stack before...
CVE-2026-74936-gc-potato
CVE-2026-74936 A not fancy reproduction. The baseline required some fiddling here. Mozilla describes this issue as a WebAssembly use-after-free. Public fix 9823b5c86ffa keeps the exact trapping wasm::Code alive in JitActivation. The test performs a bad-signature cross-instance tail call. A Debugg...
A-potential-Denial-of-Service-issue-in-protobuf-java
A-potential-Denial-of-Service-issue-in-protobuf-java A potential Denial of Service issue in protobuf-java high severity GitHub Reviewed Published 5 days ago in protocolbuffers/protobuf • Updated yesterday Vulnerability details Dependabot alerts 2 Package com.google.protobuf:protobuf-java maven...
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes. Details When CLIENTSESSIONTRACK is negotiated the...
CVE-2026-117865
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are provided as a courtesy,...
CVE-2026-111115
Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size socket.request.max.bytes; it was not checked against the...
CVE-2026-118026
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CVE-2026-117994
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-118007
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CVE-2026-117904
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...