CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2026-11065"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:17:11Z",
    "severity": "CRITICAL"
  },
  "details": "Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-m5v8-3qrp-fvxw",
  "modified": "2026-06-05T21:31:57Z",
  "published": "2026-06-05T00:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11065"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/499093536"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-05T20:29:00Z",
    "severity": "MODERATE"
  },
  "details": "cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u0027s fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.",
  "id": "GHSA-m5xr-7jg3-vh46",
  "modified": "2022-05-14T01:37:52Z",
  "published": "2022-05-14T01:37:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19876"
    },
    {
      "type": "WEB",
      "url": "https://bugs.webkit.org/show_bug.cgi?id=191595"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-39842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-29T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-m629-r54x-ffhf",
  "modified": "2022-05-24T19:16:05Z",
  "published": "2022-05-24T19:16:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39842"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb21-55.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-08T23:15:51Z",
    "severity": "HIGH"
  },
  "details": "Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition.",
  "id": "GHSA-m62j-8cr2-x42v",
  "modified": "2025-05-09T00:30:34Z",
  "published": "2025-05-09T00:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27578"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01"
    },
    {
      "type": "WEB",
      "url": "https://www.osirix-viewer.com/about/contact"
    },
    {
      "type": "WEB",
      "url": "https://www.osirix-viewer.com/osirix/osirix-md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-6971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-15T15:15:25Z",
    "severity": "HIGH"
  },
  "details": "Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted CATPRODUCT file.",
  "id": "GHSA-m63r-f3mx-hwvj",
  "modified": "2025-07-15T15:31:01Z",
  "published": "2025-07-15T15:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6971"
    },
    {
      "type": "WEB",
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49505"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:26Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: NULL out the dev-\u003erfkill to prevent UAF\n\nCommit 3e3b5dfcd16a (\"NFC: reorder the logic in nfc_{un,}register_device\")\nassumes the device_is_registered() in function nfc_dev_up() will help\nto check when the rfkill is unregistered. However, this check only\ntake effect when device_del(\u0026dev-\u003edev) is done in nfc_unregister_device().\nHence, the rfkill object is still possible be dereferenced.\n\nThe crash trace in latest kernel (5.18-rc2):\n\n[   68.760105] ==================================================================\n[   68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750\n[   68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313\n[   68.760756]\n[   68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4\n[   68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[   68.760756] Call Trace:\n[   68.760756]  \u003cTASK\u003e\n[   68.760756]  dump_stack_lvl+0x57/0x7d\n[   68.760756]  print_report.cold+0x5e/0x5db\n[   68.760756]  ? __lock_acquire+0x3ec1/0x6750\n[   68.760756]  kasan_report+0xbe/0x1c0\n[   68.760756]  ? __lock_acquire+0x3ec1/0x6750\n[   68.760756]  __lock_acquire+0x3ec1/0x6750\n[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410\n[   68.760756]  ? register_lock_class+0x18d0/0x18d0\n[   68.760756]  lock_acquire+0x1ac/0x4f0\n[   68.760756]  ? rfkill_blocked+0xe/0x60\n[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410\n[   68.760756]  ? mutex_lock_io_nested+0x12c0/0x12c0\n[   68.760756]  ? nla_get_range_signed+0x540/0x540\n[   68.760756]  ? _raw_spin_lock_irqsave+0x4e/0x50\n[   68.760756]  _raw_spin_lock_irqsave+0x39/0x50\n[   68.760756]  ? rfkill_blocked+0xe/0x60\n[   68.760756]  rfkill_blocked+0xe/0x60\n[   68.760756]  nfc_dev_up+0x84/0x260\n[   68.760756]  nfc_genl_dev_up+0x90/0xe0\n[   68.760756]  genl_family_rcv_msg_doit+0x1f4/0x2f0\n[   68.760756]  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230\n[   68.760756]  ? security_capable+0x51/0x90\n[   68.760756]  genl_rcv_msg+0x280/0x500\n[   68.760756]  ? genl_get_cmd+0x3c0/0x3c0\n[   68.760756]  ? lock_acquire+0x1ac/0x4f0\n[   68.760756]  ? nfc_genl_dev_down+0xe0/0xe0\n[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410\n[   68.760756]  netlink_rcv_skb+0x11b/0x340\n[   68.760756]  ? genl_get_cmd+0x3c0/0x3c0\n[   68.760756]  ? netlink_ack+0x9c0/0x9c0\n[   68.760756]  ? netlink_deliver_tap+0x136/0xb00\n[   68.760756]  genl_rcv+0x1f/0x30\n[   68.760756]  netlink_unicast+0x430/0x710\n[   68.760756]  ? memset+0x20/0x40\n[   68.760756]  ? netlink_attachskb+0x740/0x740\n[   68.760756]  ? __build_skb_around+0x1f4/0x2a0\n[   68.760756]  netlink_sendmsg+0x75d/0xc00\n[   68.760756]  ? netlink_unicast+0x710/0x710\n[   68.760756]  ? netlink_unicast+0x710/0x710\n[   68.760756]  sock_sendmsg+0xdf/0x110\n[   68.760756]  __sys_sendto+0x19e/0x270\n[   68.760756]  ? __ia32_sys_getpeername+0xa0/0xa0\n[   68.760756]  ? fd_install+0x178/0x4c0\n[   68.760756]  ? fd_install+0x195/0x4c0\n[   68.760756]  ? kernel_fpu_begin_mask+0x1c0/0x1c0\n[   68.760756]  __x64_sys_sendto+0xd8/0x1b0\n[   68.760756]  ? lockdep_hardirqs_on+0xbf/0x130\n[   68.760756]  ? syscall_enter_from_user_mode+0x1d/0x50\n[   68.760756]  do_syscall_64+0x3b/0x90\n[   68.760756]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   68.760756] RIP: 0033:0x7f67fb50e6b3\n...\n[   68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c\n[   68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3\n[   68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003\n[   68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c\n[   68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e\n[   68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003\n\n[   68.760756]  \u003c/TASK\u003e\n[   68.760756]\n[   68.760756] Allocated by task 279:\n[   68.760756]  kasan_save_stack+0x1e/0x40\n[\n---truncated---",
  "id": "GHSA-m645-2c8g-gg4p",
  "modified": "2025-02-27T18:31:09Z",
  "published": "2025-02-27T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49505"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1632be63862f183cd5cf1cc094e698e6ec005dfd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2a1b5110c95e4d49c8c3906270dfcde680a5a7be"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4a68938f43b7c2663e4c90bb9bbe29ac8b9a42a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4f5d71930f41be78557f9714393179025baacd65"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6abfaca8711803d0d7cc8c0fac1070a88509d463"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a8e03bcad52dc9afabf650fdbad84f739cec9efa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f81270125b50532624400063281e6611ecd61ddf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fbf9c4c714d3cdeb98b6a18e4d057f931cad1d81"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13853"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T23:16:59Z",
    "severity": "CRITICAL"
  },
  "details": "Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-m653-2xr7-9jjx",
  "modified": "2026-07-01T18:31:30Z",
  "published": "2026-07-01T00:34:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13853"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/523224019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-7911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T19:16:39Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Aura in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-m66c-p39w-x8pg",
  "modified": "2026-05-07T01:05:50Z",
  "published": "2026-05-06T21:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7911"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/497548912"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:04:38Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability",
  "id": "GHSA-m66h-xc6v-38j2",
  "modified": "2024-12-12T03:33:05Z",
  "published": "2024-12-12T03:33:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49122"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49122"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-47991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T17:15:40Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-m683-8847-xqv5",
  "modified": "2025-07-08T18:31:45Z",
  "published": "2025-07-08T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47991"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47991"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}