CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2025-39740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-11T17:15:36Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/migrate: prevent potential UAF\n\nIf we hit the error path, the previous fence (if there is one) has\nalready been put() prior to this, so doing a fence_wait could lead to\nUAF. Tweak the flow to do to the put() until after we do the wait.\n\n(cherry picked from commit 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e)",
  "id": "GHSA-p96w-fc3f-mj48",
  "modified": "2025-11-25T21:32:04Z",
  "published": "2025-09-11T18:35:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39740"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/145832fbdd17b1d77ffd6cdd1642259e101d1b7e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e46fa64a4b94208563c3a5bf1d7f4346f94abea"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-22T21:15:26Z",
    "severity": "HIGH"
  },
  "details": "Tungsten Automation Power PDF XPS File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24385.",
  "id": "GHSA-p97g-v8qv-gxjw",
  "modified": "2024-11-22T21:32:20Z",
  "published": "2024-11-22T21:32:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9732"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1337"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64787"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-17T22:17:23Z",
    "severity": "MODERATE"
  },
  "details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process termination.",
  "id": "GHSA-p984-67jc-vc4w",
  "modified": "2026-09-14T21:31:19Z",
  "published": "2026-08-18T00:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64787"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/148281"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/148282"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/148286"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/148287"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149036"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149037"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149038"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-68793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T16:16:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix a job-\u003epasid access race in gpu recovery\n\nAvoid a possible UAF in GPU recovery due to a race between\nthe sched timeout callback and the tdr work queue.\n\nThe gpu recovery function calls drm_sched_stop() and\nlater drm_sched_start().  drm_sched_start() restarts\nthe tdr queue which will eventually free the job.  If\nthe tdr queue frees the job before time out callback\ncompletes, the job will be freed and we\u0027ll get a UAF\nwhen accessing the pasid.  Cache it early to avoid the\nUAF.\n\nExample KASAN trace:\n[  493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[  493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323\n[  493.074892]\n[  493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G            E       6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)\n[  493.076493] Tainted: [E]=UNSIGNED_MODULE\n[  493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[  493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[  493.076512] Call Trace:\n[  493.076515]  \u003cTASK\u003e\n[  493.076518]  dump_stack_lvl+0x64/0x80\n[  493.076529]  print_report+0xce/0x630\n[  493.076536]  ? _raw_spin_lock_irqsave+0x86/0xd0\n[  493.076541]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  493.076545]  ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[  493.077253]  kasan_report+0xb8/0xf0\n[  493.077258]  ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[  493.077965]  amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[  493.078672]  ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[  493.079378]  ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[  493.080111]  amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[  493.080903]  ? pick_task_fair+0x24e/0x330\n[  493.080910]  ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[  493.081702]  ? _raw_spin_lock+0x75/0xc0\n[  493.081708]  ? __pfx__raw_spin_lock+0x10/0x10\n[  493.081712]  drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[  493.081721]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[  493.081725]  process_one_work+0x679/0xff0\n[  493.081732]  worker_thread+0x6ce/0xfd0\n[  493.081736]  ? __pfx_worker_thread+0x10/0x10\n[  493.081739]  kthread+0x376/0x730\n[  493.081744]  ? __pfx_kthread+0x10/0x10\n[  493.081748]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[  493.081751]  ? __pfx_kthread+0x10/0x10\n[  493.081755]  ret_from_fork+0x247/0x330\n[  493.081761]  ? __pfx_kthread+0x10/0x10\n[  493.081764]  ret_from_fork_asm+0x1a/0x30\n[  493.081771]  \u003c/TASK\u003e\n\n(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)",
  "id": "GHSA-p9c6-r3cq-rfj5",
  "modified": "2026-07-30T06:32:27Z",
  "published": "2026-01-13T18:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68793"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/77f73253015cbc7893fca1821ac3eae9eb4bc943"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dac58c012c47cadf337a35eb05d44498c43e5cd0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-118352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-27T23:17:04Z",
    "severity": "HIGH"
  },
  "details": "Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-p9cc-6jpr-c3vw",
  "modified": "2026-10-28T15:31:37Z",
  "published": "2026-10-28T00:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118352"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/569674221"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-59617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-06T21:16:52Z",
    "severity": "MODERATE"
  },
  "details": "Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.",
  "id": "GHSA-p9g7-9rvq-fcj5",
  "modified": "2026-07-06T21:30:41Z",
  "published": "2026-07-06T21:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59617"
    },
    {
      "type": "WEB",
      "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-12T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-p9gq-m942-6h3h",
  "modified": "2022-03-17T00:05:41Z",
  "published": "2022-02-13T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0106"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1278960"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-12T08:15:10Z",
    "severity": "HIGH"
  },
  "details": "Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.",
  "id": "GHSA-p9gw-j9jr-fgjm",
  "modified": "2024-04-04T06:02:15Z",
  "published": "2023-07-12T09:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2763"
    },
    {
      "type": "WEB",
      "url": "https://www.3ds.com/vulnerability/advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-28842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-15T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Bridge version 12.0.1 (and earlier versions) is affected by a Use-After-Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-p9hq-ccp8-r44h",
  "modified": "2022-06-16T00:00:20Z",
  "published": "2022-06-16T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28842"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/bridge/apsb22-25.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T09:16:16Z",
    "severity": "MODERATE"
  },
  "details": "In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431940; Issue ID: MSV-5843.",
  "id": "GHSA-p9jr-4xjc-3f6q",
  "modified": "2026-03-02T15:31:23Z",
  "published": "2026-03-02T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20437"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/March-2026"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}