172279 matches found
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Use after free in Windows Local Security Authority LSA allows an authorized attacker to elevate privileges locally...
CVE-2018-18500
CVE-2018-18500 PoC for CVE-2018-18500 - Firefox Use-After-Free Write-up: https://news.sophos.com/en-us/2019/04/18/protected-cve-2018-18500-heap-write-after-free-in-firefox-analysis-and-exploitation/...
CVE-2026-65330
CVE-2026-65330 sudo /usr/bin/perl necptrieuafpocplatform.pl --spray-count 200...
CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...
CVE-2026-109945
FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a heap use-after-free vulnerability within the smartcard emulation component. The root cause is a race condition where the SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operations occur concurrently on a single card handle. A malicious RDP ...
CVE-2026-109945
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...
CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...
CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...
CVE-2026-109676
FreeRDP versions 3.0.0-beta1 before 3.32.0 are vulnerable to a Use-After-Free vulnerability (CWE-416) within the smartcard handling component. An attacker can trigger an invalid smartcard connect operation, which allows them to access a freed smartcard handle object. This reuse of the freed handl...
CVE-2026-90140
A flaw was found in the Linux kernel's cuse module. This vulnerability, a Use-After-Free, occurs when the cuse module is unloaded before a pending Read-Copy-Update RCU callback has completed. This can lead to a system crash or, under specific circumstances, allow a local attacker to execute...
CVE-2026-90121
A flaw was found in the Linux kernel's irqchip/gic-v5 component. During the setup or teardown of Interrupt Routing System IRS affinity, the system may fail to properly clear pointers to freed memory. This can result in central processing units CPUs attempting to access memory that has already bee...
CVE-2026-90117
A flaw was found in the Linux kernel's NTFS filesystem driver. When reusing a free Master File Table MFT record, the driver fails to properly validate an offset value from the on-disk record. A local attacker could exploit this by creating a specially crafted file, leading to a use-after-free err...
CVE-2026-90113
A flaw was found in the netdevsim component of the Linux kernel. When a network queue is reset, the system fails to correctly update the association with its NAPI New API structure. This can allow a local attacker, by performing a queue reset and then initiating a queue dump via Netlink, to trigg...
CVE-2026-90093
A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...
CVE-2026-90092
A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...
CVE-2026-90071
A flaw was found in the Linux kernel's network scheduler component schteql. An issue exists where the skb-dev pointer is not correctly restored after a slave device transmit failure. This can result in a Use-After-Free UAF vulnerability if the associated network device is subsequently freed while...
openssh: openssh: a compressed payload can expand past the maximum packet size
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...
DEBIAN-CVE-2026-109765
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...