CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2026-103554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T19:17:51Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-f85h-xx7x-9chj",
  "modified": "2026-10-13T21:33:01Z",
  "published": "2026-10-13T21:33:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103554"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103554"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53084"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-02T16:15:27Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/shmem-helper: Remove another errant put in error path\n\ndrm_gem_shmem_mmap() doesn\u0027t own reference in error code path, resulting\nin the dma-buf shmem GEM object getting prematurely freed leading to a\nlater use-after-free.",
  "id": "GHSA-f85v-8gvj-9xjf",
  "modified": "2025-11-12T21:31:01Z",
  "published": "2025-05-02T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53084"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5cfb617967b05f8f27e862c97db1fabd8485f4db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/684c7372bbd6447c2e86a2a84e97a1478604d21f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/77d26c824aa5a7e0681ef1d5b75fe538d746addc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dede8c14a37a7ac458f9add56154a074ed78e7cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ee9adb7a45516cfa536ca92253d7ae59d56db9e4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:28Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - filter out async aead implementations at alloc\n\nkrb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and\nrfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL\ncompletion callback and treat any negative return from\ncrypto_aead_{encrypt,decrypt}() as terminal, falling through to\nkfree_sensitive(buffer).  When the encrypt_name resolves to an\nasync AEAD instance the request returns -EINPROGRESS, the buffer\nis freed while the backend\u0027s worker still holds a pointer, and the\nworker dereferences the freed slab on completion.\n\nKASAN report under UML+SLUB with a synthetic async aead backend\nbound to krb5-\u003eencrypt_name:\n\n  BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7\n\nThe helpers were written synchronously, so filter the async\ninstances out at allocation time instead of plumbing\ncrypto_wait_req() through every call site.\n\nReachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and\nnet/ceph/crypto.c on systems with an async AEAD provider bound to\nthe krb5 enctype name.",
  "id": "GHSA-f86v-42xw-q4vj",
  "modified": "2026-07-27T06:30:37Z",
  "published": "2026-07-25T12:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64439"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b7bd6dccff14b8b632c5244f1fd506918077221"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c9dddeb582fde005360f4fe02c760d45ca05fb5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef6feb77e2d91761427c5b773edc9c97e1b706ad"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-68284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:17Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock.  Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock-\u003ecork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n  Thread A                         Thread B\n  msg_tx = psock-\u003ecork\n  sk_msg_alloc() fails\n  sk_stream_wait_memory()\n    releases the socket lock      acquires the socket lock\n                                  completes the cork\n                                  psock-\u003ecork = NULL\n                                  frees the cork\n    reacquires the socket lock\n  msg_tx != psock-\u003ecork\n  sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again.  KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n  Read of size 4 at addr ffff88810c908800 by task poc/90\n  Call Trace:\n   sk_msg_free+0x49/0x50\n   tcp_bpf_sendmsg+0x14f5/0x1cc0\n   __sys_sendto+0x32c/0x3a0\n   __x64_sys_sendto+0xdb/0x1b0\n  Allocated by task 89:\n   __kasan_kmalloc+0x8f/0xa0\n   tcp_bpf_sendmsg+0x16b3/0x1cc0\n  Freed by task 91:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock-\u003ecork cannot turn a shared message into\nan apparent local one.",
  "id": "GHSA-f87h-88f3-m92w",
  "modified": "2026-08-19T18:32:12Z",
  "published": "2026-08-10T15:33:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68284"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T19:17:09Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-f88h-fjvm-fgph",
  "modified": "2026-06-24T21:30:43Z",
  "published": "2026-06-24T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13031"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/523308824"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-3743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-13T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .",
  "id": "GHSA-f89f-x4qh-9gfp",
  "modified": "2022-05-24T17:08:58Z",
  "published": "2022-05-24T17:08:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3743"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-05.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-6973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-15T15:15:26Z",
    "severity": "HIGH"
  },
  "details": "Use After Free vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file.",
  "id": "GHSA-f8cc-54wr-7853",
  "modified": "2025-07-15T15:31:01Z",
  "published": "2025-07-15T15:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6973"
    },
    {
      "type": "WEB",
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-1307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-05-15T03:36:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka \"Internet Explorer Use After Free Vulnerability,\" a different vulnerability than CVE-2013-0811.",
  "id": "GHSA-f8fq-fr63-cf87",
  "modified": "2022-05-14T02:34:43Z",
  "published": "2022-05-14T02:34:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1307"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16650"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-134A"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-47318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T15:15:19Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\narch_topology: Avoid use-after-free for scale_freq_data\n\nCurrently topology_scale_freq_tick() (which gets called from\nscheduler_tick()) may end up using a pointer to \"struct\nscale_freq_data\", which was previously cleared by\ntopology_clear_scale_freq_source(), as there is no protection in place\nhere. The users of topology_clear_scale_freq_source() though needs a\nguarantee that the previously cleared scale_freq_data isn\u0027t used\nanymore, so they can free the related resources.\n\nSince topology_scale_freq_tick() is called from scheduler tick, we don\u0027t\nwant to add locking in there. Use the RCU update mechanism instead\n(which is already used by the scheduler\u0027s utilization update path) to\nguarantee race free updates here.\n\nsynchronize_rcu() makes sure that all RCU critical sections that started\nbefore it is called, will finish before it returns. And so the callers\nof topology_clear_scale_freq_source() don\u0027t need to worry about their\ncallback getting called anymore.",
  "id": "GHSA-f8fr-xvcp-37m8",
  "modified": "2024-12-26T21:30:36Z",
  "published": "2024-05-21T15:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47318"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/83150f5d05f065fb5c12c612f119015cabdcc124"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ccdf7e073170886bc370c613e269de610a794c4a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52838"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T16:15:21Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: imsttfb: fix a resource leak in probe\n\nI\u0027ve re-written the error handling but the bug is that if init_imstt()\nfails we need to call iounmap(par-\u003ecmap_regs).",
  "id": "GHSA-f8gg-2gx7-phw9",
  "modified": "2024-12-04T18:32:34Z",
  "published": "2024-05-21T18:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52838"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18d26f9baca7d0d309303e3074a2252b8310884a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/382e1931e0c9cd58a5a8519cdc6cd9dc4d82b485"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c66d737b2726ac7784269ddf32a31634f8f269d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7bc7b82fb2191b0d50a80ee4e27030918767dd1d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e4b510fe91782522b7ca0ca881b663b5d35e513"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4dfebec32ec6d420a5506dd56a7834c91be28e4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b346a531159d08c564a312a9eaeea691704f3c00"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}