Clipboard User Service Elevation of Privilege Vulnerability

Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally...

Windows Telephony Server Elevation of Privilege Vulnerability

Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally...

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2018-18500

CVE-2018-18500 PoC for CVE-2018-18500 - Firefox Use-After-Free Write-up: https://news.sophos.com/en-us/2019/04/18/protected-cve-2018-18500-heap-write-after-free-in-firefox-analysis-and-exploitation/...

CVE-2026-65330

CVE-2026-65330 sudo /usr/bin/perl necptrieuafpocplatform.pl --spray-count 200...

CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109945

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a heap use-after-free vulnerability within the smartcard emulation component. The root cause is a race condition where the SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operations occur concurrently on a single card handle. A malicious RDP ...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109676

FreeRDP versions 3.0.0-beta1 before 3.32.0 are vulnerable to a Use-After-Free vulnerability (CWE-416) within the smartcard handling component. An attacker can trigger an invalid smartcard connect operation, which allows them to access a freed smartcard handle object. This reuse of the freed handl...

CVE-2026-90140

A flaw was found in the Linux kernel's cuse module. This vulnerability, a Use-After-Free, occurs when the cuse module is unloaded before a pending Read-Copy-Update RCU callback has completed. This can lead to a system crash or, under specific circumstances, allow a local attacker to execute...

CVE-2026-90121

A flaw was found in the Linux kernel's irqchip/gic-v5 component. During the setup or teardown of Interrupt Routing System IRS affinity, the system may fail to properly clear pointers to freed memory. This can result in central processing units CPUs attempting to access memory that has already bee...

CVE-2026-90117

A flaw was found in the Linux kernel's NTFS filesystem driver. When reusing a free Master File Table MFT record, the driver fails to properly validate an offset value from the on-disk record. A local attacker could exploit this by creating a specially crafted file, leading to a use-after-free err...

CVE-2026-90113

A flaw was found in the netdevsim component of the Linux kernel. When a network queue is reset, the system fails to correctly update the association with its NAPI New API structure. This can allow a local attacker, by performing a queue reset and then initiating a queue dump via Netlink, to trigg...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...

CVE-2026-90071

A flaw was found in the Linux kernel's network scheduler component schteql. An issue exists where the skb-dev pointer is not correctly restored after a slave device transmit failure. This can result in a Use-After-Free UAF vulnerability if the associated network device is subsequently freed while...

openssh: openssh: a compressed payload can expand past the maximum packet size

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...