CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2026-14111"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T23:17:22Z",
    "severity": "HIGH"
  },
  "details": "Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)",
  "id": "GHSA-9wj7-crvx-83v4",
  "modified": "2026-07-01T15:35:09Z",
  "published": "2026-07-01T00:34:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14111"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/513710926"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T15:15:07Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix UAF when detecting digest errors\n\nWe should also bail from the io_work loop when we set rd_enabled to true,\nso we don\u0027t attempt to read data from the socket when the TCP stream is\nalready out-of-sync or corrupted.",
  "id": "GHSA-9wjv-frj6-hjv9",
  "modified": "2024-06-03T18:53:45Z",
  "published": "2024-05-03T15:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48686"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/13c80a6c112467bab5e44d090767930555fc17a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/160f3549a907a50e51a8518678ba2dcf2541abea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/19816a0214684f70b49b25075ff8c402fdd611d3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5914fa32ef1b7766fea933f9eed94ac5c00aa7ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c3eb461aa56e6fa94fb80442ba2586bd223a8886"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:27Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan-\u003econn. If\nthe connection is torn down while the timer is running or pending,\nchan-\u003econn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn-\u003elock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n|  \u003cTASK\u003e\n|  instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n|  atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n|  __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n|  mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n|  l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n|  process_one_work kernel/workqueue.c:3326 [inline]\n|  process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n|  worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n|  kthread+0x346/0x430 kernel/kthread.c:436\n|  ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n|  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|  \u003c/TASK\u003e\n|\n| Allocated by task 320:\n|  l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n|  l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n|  hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n|  hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n|  hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n|  hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n|  hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n|  process_one_work kernel/workqueue.c:3326 [inline]\n|  process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n|  worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n|  kthread+0x346/0x430 kernel/kthread.c:436\n|  ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n|  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n|  hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n|  hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n|  hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n|  hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n|  hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n|  vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n|  __fput+0x369/0x890 fs/file_table.c:510\n|  task_work_run+0x160/0x1d0 kernel/task_work.c:233\n|  get_signal+0xf5b/0x1120 kernel/signal.c:2810\n|  arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n|  __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n|  exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n|  do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n|  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n|  which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n|  freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan-\u003econn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---",
  "id": "GHSA-9wm7-g2v6-vprf",
  "modified": "2026-08-19T18:32:01Z",
  "published": "2026-07-25T12:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64434"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-69573"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T18:19:26Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-9wmr-xfr8-c76q",
  "modified": "2026-09-08T18:32:46Z",
  "published": "2026-09-08T18:32:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69573"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69573"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-13278"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-04T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70546581.",
  "id": "GHSA-9wp8-phpf-x626",
  "modified": "2022-05-14T03:26:42Z",
  "published": "2022-05-14T03:26:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13278"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2018-04-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48754"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-20T12:15:13Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nphylib: fix potential use-after-free\n\nCommit bafbdd527d56 (\"phylib: Add device reset GPIO support\") added call\nto phy_device_reset(phydev) after the put_device() call in phy_detach().\n\nThe comment before the put_device() call says that the phydev might go\naway with put_device().\n\nFix potential use-after-free by calling phy_device_reset() before\nput_device().",
  "id": "GHSA-9wpf-m764-qmf8",
  "modified": "2024-07-03T18:46:09Z",
  "published": "2024-06-20T12:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48754"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/67d271760b037ce0806d687ee6057edc8afd4205"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aefaccd19379d6c4620269a162bfb88ff687f289"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd024e36f68174b1793906c39ca16cee0c9295c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb2fab10fc5e7a3aa1bb0a68a3abdcf3e37852af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cbda1b16687580d5beee38273f6241ae3725960c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f39027cbada43b33566c312e6be3db654ca3ad17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-8029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-20T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.",
  "id": "GHSA-9wpg-hwwr-58j7",
  "modified": "2022-05-24T16:54:13Z",
  "published": "2022-05-24T16:54:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8029"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb19-41.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-17672"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-24T04:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of array indices. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6817.",
  "id": "GHSA-9wq3-prjm-cxv3",
  "modified": "2022-05-13T01:33:53Z",
  "published": "2022-05-13T01:33:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17672"
    },
    {
      "type": "WEB",
      "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-18-1159"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-12T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Web packaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-9wqr-mpwr-rf7h",
  "modified": "2022-02-20T00:00:49Z",
  "published": "2022-02-15T00:02:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0293"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1283371"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-11223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-08-11T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the core of the XFA engine. Successful exploitation could lead to arbitrary code execution.",
  "id": "GHSA-9wrh-779f-xpf3",
  "modified": "2025-04-20T03:43:00Z",
  "published": "2022-05-14T01:20:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11223"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb17-24.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100182"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039098"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-588"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}