Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
10310 vulnerabilities reference this CWE, most recent first.
CVE-2026-82631 (GCVE-0-2026-82631)
Vulnerability from cvelistv5 – Published: 2026-08-31 07:45 – Updated: 2026-08-31 11:33 X_Open Source
VLAI
EPSS
VEX
Title
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
Summary
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 11:22 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397129 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397129/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82631 | third-party-advisory |
| https://vuldb.com/submit/893793 | third-party-advisory |
| https://github.com/valkey-io/valkey/issues/4198 | issue-tracking |
| https://github.com/valkey-io/valkey/pull/4212 | issue-trackingpatch |
| https://github.com/user-attachments/files/3011162… | exploit |
| https://github.com/valkey-io/valkey/commit/b2fb0e… | patch |
| https://github.com/valkey-io/valkey/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T11:22:07.646542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T11:33:30.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:*"
],
"modules": [
"Blocked-on-keys Subsystem"
],
"product": "valkey",
"vendor": "valkey-io",
"versions": [
{
"status": "affected",
"version": "9.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "VULL (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:N/AC:H/Au:M/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T07:45:13.359Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397129 | valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397129"
},
{
"name": "VDB-397129 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397129/cti"
},
{
"name": "CVE-2026-82631 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82631"
},
{
"name": "Submit #893793 | Valkey Project Valkey 9.1.0 Heap Use After Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893793"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/valkey-io/valkey/issues/4198"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/valkey-io/valkey/pull/4212"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/30111628/PoC.zip"
},
{
"tags": [
"patch"
],
"url": "https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b"
},
{
"tags": [
"product"
],
"url": "https://github.com/valkey-io/valkey/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T12:15:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82631",
"datePublished": "2026-08-31T07:45:13.359Z",
"dateReserved": "2026-08-30T10:10:33.072Z",
"dateUpdated": "2026-08-31T11:33:30.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82623 (GCVE-0-2026-82623)
Vulnerability from cvelistv5 – Published: 2026-08-31 06:15 – Updated: 2026-08-31 16:24
VLAI
EPSS
VEX
Title
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
Summary
A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397123 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397123/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82623 | third-party-advisory |
| https://vuldb.com/submit/893207 | third-party-advisory |
| https://github.com/open62541/open62541/issues/8199 | exploitissue-tracking |
| https://github.com/open62541/open62541/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82623",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:24:14.514669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:24:19.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/893207"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*"
],
"modules": [
"History Backend"
],
"product": "open62541",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.5.0"
},
{
"status": "affected",
"version": "1.5.1"
},
{
"status": "affected",
"version": "1.5.2"
},
{
"status": "affected",
"version": "1.5.3"
},
{
"status": "affected",
"version": "1.5.4"
},
{
"status": "affected",
"version": "1.5.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "VULL (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T06:15:08.682Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397123 | open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397123"
},
{
"name": "VDB-397123 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397123/cti"
},
{
"name": "CVE-2026-82623 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82623"
},
{
"name": "Submit #893207 | open62541 Project open62541 1.5.5 Use After Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893207"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/open62541/open62541/issues/8199"
},
{
"tags": [
"product"
],
"url": "https://github.com/open62541/open62541/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T10:09:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82623",
"datePublished": "2026-08-31T06:15:08.682Z",
"dateReserved": "2026-08-30T08:04:53.909Z",
"dateUpdated": "2026-08-31T16:24:19.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82619 (GCVE-0-2026-82619)
Vulnerability from cvelistv5 – Published: 2026-08-31 05:15 – Updated: 2026-08-31 15:45
VLAI
EPSS
VEX
Title
Systerel S2OPC subscription_mgr.c use after free
Summary
A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:45 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397119 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397119/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82619 | third-party-advisory |
| https://vuldb.com/submit/893148 | third-party-advisory |
| https://gitlab.com/systerel/S2OPC/-/work_items/1797 | exploit |
| https://gitlab.com/systerel/S2OPC/-/merge_requests/1839 | patch |
| https://gitlab.com/systerel/S2OPC/-/commit/a4cee1… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82619",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:45:28.618433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:45:39.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:systerel:s2opc:*:*:*:*:*:*:*:*"
],
"product": "S2OPC",
"vendor": "Systerel",
"versions": [
{
"status": "affected",
"version": "1.7.0"
},
{
"status": "affected",
"version": "1.7.1"
},
{
"status": "affected",
"version": "1.7.2"
},
{
"status": "affected",
"version": "1.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "VULL (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T05:15:10.327Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397119 | Systerel S2OPC subscription_mgr.c use after free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397119"
},
{
"name": "VDB-397119 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397119/cti"
},
{
"name": "CVE-2026-82619 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82619"
},
{
"name": "Submit #893148 | Systerel S2OPC OPC UA Toolkit 1.7.3 Heap Use After Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893148"
},
{
"tags": [
"exploit"
],
"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1797"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/systerel/S2OPC/-/merge_requests/1839"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/systerel/S2OPC/-/commit/a4cee16a851b971be447a6ed531173702c722b99"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T10:03:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Systerel S2OPC subscription_mgr.c use after free",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82619",
"datePublished": "2026-08-31T05:15:10.327Z",
"dateReserved": "2026-08-30T07:58:26.515Z",
"dateUpdated": "2026-08-31T15:45:39.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81934 (GCVE-0-2026-81934)
Vulnerability from cvelistv5 – Published: 2026-08-27 19:40 – Updated: 2026-08-31 19:17
VLAI
EPSS
VEX
Title
Redis TLS pending-data list use-after-free
Summary
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-27 19:12 UTC
CWE
- CWE-416 - Use After Free
References
24 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Redis | Redis |
Unaffected:
8.2.9
Unaffected: 8.4.6 Unaffected: 8.6.6 Unaffected: 8.8.2 Unaffected: 8.10.1 Unaffected: 7.4.11 Unaffected: 6.2.24 Unaffected: 7.2.16 Affected: 0 , < 8.8.2 (custom) Affected: 0 , < 8.2.9 (custom) Affected: 0 , < 8.4.6 (custom) Affected: 0 , < 8.6.6 (custom) Affected: 0 , < 8.10.1 (custom) Affected: 0 , < 7.4.11 (custom) Affected: 0 , < 6.2.24 (custom) Affected: 0 , < 7.2.16 (custom) |
|
| Redis | Redis Software (Enterprise) |
Unaffected:
8.2.0-46
Unaffected: 8.0.20-96 Unaffected: 7.22.2-179 Unaffected: 7.8.6-303 Affected: 0 , < 8.2.0-46 (custom) Affected: 0 , < 8.0.20-96 (custom) Affected: 0 , < 7.22.2-179 (custom) Affected: 0 , < 7.8.6-303 (custom) |
Date Public
2026-08-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81934",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:13:56.058373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:14:13.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Redis",
"vendor": "Redis",
"versions": [
{
"status": "unaffected",
"version": "8.2.9"
},
{
"status": "unaffected",
"version": "8.4.6"
},
{
"status": "unaffected",
"version": "8.6.6"
},
{
"status": "unaffected",
"version": "8.8.2"
},
{
"status": "unaffected",
"version": "8.10.1"
},
{
"status": "unaffected",
"version": "7.4.11"
},
{
"status": "unaffected",
"version": "6.2.24"
},
{
"status": "unaffected",
"version": "7.2.16"
},
{
"lessThan": "8.8.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.4.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.6.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.10.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.4.11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.2.24",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.2.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Redis Software (Enterprise)",
"vendor": "Redis",
"versions": [
{
"status": "unaffected",
"version": "8.2.0-46"
},
{
"status": "unaffected",
"version": "8.0.20-96"
},
{
"status": "unaffected",
"version": "7.22.2-179"
},
{
"status": "unaffected",
"version": "7.8.6-303"
},
{
"lessThan": "8.2.0-46",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.0.20-96",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.22.2-179",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.8.6-303",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Redis contains a use-after-free vulnerability in the \u0027tlsProcessPendingData()\u0027 function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81934",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T19:12:51.964039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:17:53.121Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"patch"
],
"url": "https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834"
},
{
"name": "url",
"tags": [
"exploit"
],
"url": "https://github.com/v12-security/pocs/tree/main/redis/server_ssl"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81934"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/6.2.24"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/7.2.16"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/7.4.11"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/8.4.6"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/8.2.9"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/8.6.6"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/8.8.2"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/redis/redis/releases/tag/8.10.1"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES"
},
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES"
}
],
"title": "Redis TLS pending-data list use-after-free"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-81934",
"datePublished": "2026-08-27T19:40:15.141Z",
"dateReserved": "2026-08-27T19:15:11.715Z",
"dateUpdated": "2026-08-31T19:17:53.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78376 (GCVE-0-2026-78376)
Vulnerability from cvelistv5 – Published: 2026-08-24 13:29 – Updated: 2026-08-25 13:46
VLAI
EPSS
VEX
Title
Webkitgtk: use-after-free of jscvalue function parameters
Summary
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-78376 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2521858 | issue-trackingx_refsource_REDHAT |
| https://github.com/WebKit/WebKit/pull/72142 |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WebKit | WebKit |
Affected:
2.21.1 , < *
(semver)
|
|
| WebKitGTK | WebKitGTK |
Affected:
2.21.1 , < *
(semver)
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:09.994Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://webkit.org/",
"defaultStatus": "unaffected",
"packageName": "webkit",
"product": "WebKit",
"vendor": "WebKit",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "2.21.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://webkitgtk.org/",
"defaultStatus": "unaffected",
"packageName": "webkitgtk",
"product": "WebKitGTK",
"vendor": "WebKitGTK",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "2.21.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "webkitgtk",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "webkitgtk3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "webkitgtk4",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "webkit2gtk3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "webkit2gtk3",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Igalia for reporting this issue."
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T13:46:08.141Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-78376"
},
{
"name": "RHBZ#2521858",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521858"
},
{
"url": "https://github.com/WebKit/WebKit/pull/72142"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T13:01:28.703Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Webkitgtk: use-after-free of jscvalue function parameters",
"workarounds": [
{
"lang": "en",
"value": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-416: Use After Free"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-78376",
"datePublished": "2026-08-24T13:29:17.412Z",
"dateReserved": "2026-08-24T13:13:58.950Z",
"dateUpdated": "2026-08-25T13:46:08.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77358 (GCVE-0-2026-77358)
Vulnerability from cvelistv5 – Published: 2026-08-27 22:37 – Updated: 2026-08-31 18:25
VLAI
EPSS
VEX
Title
cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
Summary
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:25 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/yhirose/cpp-httplib/security/a… | x_refsource_CONFIRM |
| https://github.com/yhirose/cpp-httplib/commit/2f9… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yhirose | cpp-httplib |
Affected:
>= 0.33.0, < 0.50.
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77358",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:25:12.543647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:25:37.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-w7p7-f35j-mw7q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cpp-httplib",
"vendor": "yhirose",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.33.0, \u003c 0.50."
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client\u0027s destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T22:37:14.339Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-w7p7-f35j-mw7q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-w7p7-f35j-mw7q"
},
{
"name": "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d"
}
],
"source": {
"advisory": "GHSA-w7p7-f35j-mw7q",
"discovery": "UNKNOWN"
},
"title": "cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77358",
"datePublished": "2026-08-27T22:37:14.339Z",
"dateReserved": "2026-08-20T19:28:35.245Z",
"dateUpdated": "2026-08-31T18:25:37.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77235 (GCVE-0-2026-77235)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:42 – Updated: 2026-08-27 16:46
VLAI
EPSS
VEX
Title
Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
Summary
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to version 11.3.1 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 16:08 UTC
CWE
- CWE-416 - Use after free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FreeRTOS/FreeRTOS-Kernel/relea… | patch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/FreeRTOS/FreeRTOS-Kernel/secur… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FreeRTOS | FreeRTOS-Kernel |
Affected:
10.2.0 , ≤ 11.3.0
(custom)
cpe:2.3:a:freertos:freertos-kernel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77235",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T16:08:09.226735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:46:35.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRTOS-Kernel",
"vendor": "FreeRTOS",
"versions": [
{
"lessThanOrEqual": "11.3.0",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freertos:freertos-kernel:*:*:*:*:*:*:*:*",
"versionEndIncluding": "11.3.0",
"versionStartIncluding": "10.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NVIDIA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation.\u0026nbsp;To remediate this issue, users should upgrade to version\u0026nbsp;11.3.1 or later.\u003c/p\u003e"
}
],
"value": "Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation.\u00a0To remediate this issue, users should upgrade to version\u00a011.3.1 or later."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 (Pointer Manipulation)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:42:23.681Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-086-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-55pf-q87x-c58c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-77235",
"datePublished": "2026-08-21T17:42:12.312Z",
"dateReserved": "2026-08-20T18:42:39.750Z",
"dateUpdated": "2026-08-27T16:46:35.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76957 (GCVE-0-2026-76957)
Vulnerability from cvelistv5 – Published: 2026-08-20 04:28 – Updated: 2026-08-20 15:26
VLAI
EPSS
VEX
Summary
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 15:05 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libexpat project | libexpat |
Affected:
0 , < 2.8.4
(semver)
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:05:41.792254Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:26:27.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libexpat",
"vendor": "libexpat project",
"versions": [
{
"lessThan": "2.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T04:28:04.788Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/libexpat/libexpat/pull/1322"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1329"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-76957",
"datePublished": "2026-08-20T04:28:04.788Z",
"dateReserved": "2026-08-20T04:28:04.012Z",
"dateUpdated": "2026-08-20T15:26:27.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76921 (GCVE-0-2026-76921)
Vulnerability from cvelistv5 – Published: 2026-08-19 22:45 – Updated: 2026-08-20 15:26
VLAI
EPSS
VEX
Title
Use After Free in Wireshark
Summary
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 15:07 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wireshark Foundation | Wireshark |
Affected:
4.6.0 , < 4.6.8
(semver)
Affected: 4.4.0 , < 4.4.18 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:07:10.342098Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:26:29.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.8",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.18",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aisle Research (Dmitrijs Trizna, Luigino Camastra, Ze Sheng (O2Lab \u0026 TAMU), Igor Morgenstern)"
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T22:45:20.517Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://www.wireshark.org/security/wnpa-sec-2026-83.html"
},
{
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21457"
},
{
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21458"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 4.6.8 or above"
}
],
"title": "Use After Free in Wireshark"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-76921",
"datePublished": "2026-08-19T22:45:20.517Z",
"dateReserved": "2026-08-19T22:44:30.531Z",
"dateUpdated": "2026-08-20T15:26:29.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73282 (GCVE-0-2026-73282)
Vulnerability from cvelistv5 – Published: 2026-08-11 19:12 – Updated: 2026-08-11 20:17
VLAI
EPSS
VEX
Summary
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 20:17 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73282",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T20:17:11.294681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:17:22.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSH",
"vendor": "OpenBSD",
"versions": [
{
"lessThan": "10.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T19:12:24.334Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.openssh.org/releasenotes.html#10.5"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-73282",
"datePublished": "2026-08-11T19:12:24.334Z",
"dateReserved": "2026-08-11T19:12:24.011Z",
"dateUpdated": "2026-08-11T20:17:22.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.