CWE-415 CVEs | Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 998 matches · 0 in Waratek scope · 0 protected · 11 exploited · 6 CISA KEV · 21 public PoC · 6 EPSS ≥ 0.5

998matches 0in Waratek scope0.0% 0protected0.0% 11exploited1.1% 6CISA KEV0.6% 21public PoC2.1% 6EPSS ≥ 0.50.6%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 5 0.5% Not applicable 993 99.5% Withdrawn CVE 0 0.0%

Critical 142 14.2% High 661 66.2% Medium 178 17.8% Low 17 1.7% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 998 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 11 1.1% Working exploit published 11 1.1% Proof of concept only 53 5.3% Forecast only 2 0.2% No public exploit 921 92.3%

split by StatusSeverityProtectionExploit maturity peak 299 / year

2002200420062008201020122014201620182020202220242026

998 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2026-128017	Medium	2026-11-13	Not applicable	Proof of concept only	FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.
CVE-2026-120221	High	2026-11-13	Not applicable	No public exploit	In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.
CVE-2026-100290	Low	2026-11-11	Not applicable	No public exploit	The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.
CVE-2026-96969	High	2026-11-10	Not applicable	No public exploit	Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-96115	High	2026-11-10	Not applicable	No public exploit	Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.
CVE-2026-95961	High	2026-11-10	Not applicable	No public exploit	Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-95934	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95901	Critical	2026-11-10	Not applicable	No public exploit	Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
CVE-2026-88218	Critical	2026-11-10	Not applicable	No public exploit	Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
CVE-2026-85862	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-122163	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
CVE-2026-119992	High	2026-11-10	Not applicable	No public exploit	Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-119964	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
CVE-2026-119963	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
CVE-2026-119962	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.
CVE-2026-119957	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
CVE-2026-119934	High	2026-11-10	Not applicable	No public exploit	Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-119912	Medium	2026-11-10	Not applicable	No public exploit	Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-119817	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-119399	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-118719	High	2026-11-10	Not applicable	No public exploit	Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118702	High	2026-11-10	Not applicable	No public exploit	Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118296	High	2026-11-10	Not applicable	No public exploit	Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118220	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Multiple Provider Router allows an authorized attacker to elevate privileges locally.
CVE-2026-112796	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.
CVE-2026-112758	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2026-109503	High	2026-11-10	Not applicable	No public exploit	Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-105566	High	2026-11-10	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-105547	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVE-2026-105545	High	2026-11-10	Not applicable	No public exploit	An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.
CVE-2026-105526	High	2026-11-10	Not applicable	No public exploit	Double free in Winsock allows an authorized attacker to elevate privileges locally.
CVE-2026-105496	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-105025	High	2026-11-10	Not applicable	No public exploit	Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-103571	High	2026-11-10	Not applicable	No public exploit	An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how the Windows CNG Key Isolation Service handles memory.
CVE-2026-125269	High	2026-11-09	Not applicable	No public exploit	FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.
CVE-2026-68994	High	2026-11-05	Not applicable	No public exploit	A double free vulnerability in NPU driver due to improper pointer management (941)
CVE-2026-68993	Medium	2026-11-05	Not applicable	No public exploit	A double free vulnerability in NPU driver due to improper pointer management (940)
CVE-2026-92211	High	2026-11-04	Not applicable	No public exploit	Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.
CVE-2026-121956	High	2026-11-04	Not applicable	Proof of concept only	FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.
CVE-2026-121507	Medium	2026-11-03	Not applicable	No public exploit	Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure
CVE-2026-58968	Critical	2026-11-02	Not applicable	No public exploit	In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-20582	Medium	2026-11-02	Not applicable	No public exploit	In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.
CVE-2026-20573	Medium	2026-11-02	Not applicable	No public exploit	In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.
CVE-2026-119338	Medium	2026-10-30	Not applicable	Proof of concept only	Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
CVE-2026-119116	High	2026-10-30	Not applicable	No public exploit	A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.
CVE-2026-85890	High	2026-10-29	Not applicable	No public exploit	Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-88812	High	2026-10-27	Not applicable	No public exploit	A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
CVE-2026-83831	High	2026-10-27	Not applicable	No public exploit	Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-117943	High	2026-10-27	Not applicable	No public exploit	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-116743	Medium	2026-10-26	Not applicable	Proof of concept only	libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
CVE-2026-116260	Medium	2026-10-26	Not applicable	Proof of concept only	A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-112457	High	2026-10-26	Not applicable	No public exploit	A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.
CVE-2026-112410	High	2026-10-26	Not applicable	No public exploit	A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may cause an unexpected process termination.
CVE-2026-94300	High	2026-10-21	Not applicable	No public exploit	Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-78116	Medium	2026-10-21	Not applicable	No public exploit	The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_error_on_result(), which finalises the request with rtio_iodev_sqe_err(), but execution then fell through to the tail of the function and finalised the very same struct rtio_iodev_sqe a second time with rtio_iodev_sqe_ok(). Unlike the other error branches in the same function, this one did not return. Both completion helpers reach rtio_executor_done() in subsys/rtio/rtio_executor.c, which returns the submission to the pool via rtio_sqe_pool_free() and, for streaming (multishot) submissions, also releases the RX buffer with rtio_release_buffer(). The second completion therefore reads a freed rtio_iodev_sqe, pushes the same mpsc node onto the submission queue while it is already on the pool free list — splicing the two lists together — and re-submits the freed request so the next measurement is written through an already-released buffer. For one-shot submissions it emits a spurious success completion carrying stale userdata and frees the same pool entry twice. The failure branch is driven by sensor conditions rather than by host software. The vendor API documents statuses such as ERROR_ARGUS_BIAS_VOLTAGE_REINIT and ERROR_ARGUS_LASER_MONITOR_INACTIVE as transient results of harsh ambient light, so a party in front of the optical sensor can provoke the invalid-data condition without any physical contact with the board or any software access; SPI transfer errors reach the same branch. In releases before the payload.Status check was dropped, ordinary sharp distance transitions in the sensor's field of view were sufficient. Impact is corruption of the RTIO submission pool and mempool bookkeeping: aliased submissions, writes through released buffers, and duplicate completions delivered to the application. The attacker does not control the corrupted content, so the practical consequence is memory corruption and loss of availability on devices that instantiate brcm,afbr-s50, rather than directed code execution. Only builds that enable this driver are affected.
CVE-2026-86962	Medium	2026-10-20	Not applicable	No public exploit	A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-112036	Low	2026-10-19	Not applicable	Proof of concept only	A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
CVE-2026-57446	Medium	2026-10-16	Not applicable	Proof of concept only	libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.
CVE-2026-94370	Medium	2026-10-14	Not applicable	No public exploit	A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
CVE-2026-110599	Medium	2026-10-14	Not applicable	Proof of concept only	L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
CVE-2026-97830	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
CVE-2026-97812	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97811	High	2026-10-13	Not applicable	No public exploit	Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVE-2026-97772	High	2026-10-13	Not applicable	No public exploit	Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97767	High	2026-10-13	Not applicable	No public exploit	Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97749	Critical	2026-10-13	Not applicable	No public exploit	Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-96864	Critical	2026-10-13	Not applicable	No public exploit	Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
CVE-2026-95943	High	2026-10-13	Not applicable	No public exploit	Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-95635	High	2026-10-13	Not applicable	No public exploit	Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-88171	High	2026-10-13	Not applicable	No public exploit	Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88149	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-88071	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-85936	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
CVE-2026-85904	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85829	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
CVE-2026-84012	High	2026-10-13	Not applicable	No public exploit	Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2026-83916	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
CVE-2026-83842	High	2026-10-13	Not applicable	No public exploit	Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-83634	High	2026-10-13	Not applicable	No public exploit	Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
CVE-2026-70158	High	2026-10-13	Not applicable	No public exploit	Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVE-2026-70062	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
CVE-2026-109943	High	2026-10-13	Not applicable	Proof of concept only	FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
CVE-2026-108132	High	2026-10-13	Not applicable	No public exploit	Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVE-2026-106175	Low	2026-10-13	Not applicable	No public exploit	A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
CVE-2026-104192	Critical	2026-10-13	Not applicable	No public exploit	Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
CVE-2026-109271	Medium	2026-10-12	Not applicable	No public exploit	ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.
CVE-2026-109257	High	2026-10-12	Not applicable	Proof of concept only	FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
CVE-2026-95702	High	2026-10-09	Not applicable	No public exploit	Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
CVE-2026-5759	Critical	2026-10-09	Not applicable	No public exploit	A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
CVE-2026-108104	Medium	2026-10-09	Not applicable	No public exploit	Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
CVE-2026-107886	Medium	2026-10-09	Not applicable	Proof of concept only	OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
CVE-2026-104113	Medium	2026-10-09	Not applicable	No public exploit	A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.
CVE-2026-107209	High	2026-10-07	Not applicable	No public exploit	ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
CVE-2026-20532	Medium	2026-10-05	Not applicable	No public exploit	In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168.
CVE-2026-47558	High	2026-09-30	Not applicable	No public exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVE-2026-98154	High	2026-09-25	Not applicable	No public exploit	In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
CVE-2026-89078	Critical	2026-09-24	Not applicable	No public exploit	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
CVE-2026-6794	High	2026-09-23	Not applicable	No public exploit	IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
CVE-2026-91018	High	2026-09-22	Not applicable	No public exploit	lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
CVE-2026-11388	Medium	2026-09-22	Not applicable	No public exploit	Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2026-128017

Medium

2026-11-13

Not applicable

Proof of concept only

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

CVE-2026-120221

High

2026-11-13

Not applicable

No public exploit

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.

CVE-2026-100290

Low

2026-11-11

Not applicable

No public exploit

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.

CVE-2026-96969

High

2026-11-10

Not applicable

No public exploit

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVE-2026-96115

High

2026-11-10

Not applicable

No public exploit

Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.

CVE-2026-95961

High

2026-11-10

Not applicable

No public exploit

Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-95934

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

CVE-2026-95901

Critical

2026-11-10

Not applicable

No public exploit

Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

CVE-2026-88218

Critical

2026-11-10

Not applicable

No public exploit

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-85862

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2026-122163

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

CVE-2026-119992

High

2026-11-10

Not applicable

No public exploit

Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

CVE-2026-119964

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

CVE-2026-119963

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

CVE-2026-119962

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.

CVE-2026-119957

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

CVE-2026-119934

High

2026-11-10

Not applicable

No public exploit

Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-119912

Medium

2026-11-10

Not applicable

No public exploit

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-119817

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-119399

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-118719

High

2026-11-10

Not applicable

No public exploit

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-118702

High

2026-11-10

Not applicable

No public exploit

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-118296

High

2026-11-10

Not applicable

No public exploit

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-118220

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Multiple Provider Router allows an authorized attacker to elevate privileges locally.

CVE-2026-112796

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.

CVE-2026-112758

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

CVE-2026-109503

High

2026-11-10

Not applicable

No public exploit

Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-105566

High

2026-11-10

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-105547

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

CVE-2026-105545

High

2026-11-10

Not applicable

No public exploit

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

CVE-2026-105526

High

2026-11-10

Not applicable

No public exploit

Double free in Winsock allows an authorized attacker to elevate privileges locally.

CVE-2026-105496

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

CVE-2026-105025

High

2026-11-10

Not applicable

No public exploit

Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

CVE-2026-103571

High

2026-11-10

Not applicable

No public exploit

An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how the Windows CNG Key Isolation Service handles memory.

CVE-2026-125269

High

2026-11-09

Not applicable

No public exploit

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.

CVE-2026-68994

High

2026-11-05

Not applicable

No public exploit

A double free vulnerability in NPU driver due to improper pointer management (941)

CVE-2026-68993

Medium

2026-11-05

Not applicable

No public exploit

A double free vulnerability in NPU driver due to improper pointer management (940)

CVE-2026-92211

High

2026-11-04

Not applicable

No public exploit

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.

CVE-2026-121956

High

2026-11-04

Not applicable

Proof of concept only

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

CVE-2026-121507

Medium

2026-11-03

Not applicable

No public exploit

Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure

CVE-2026-58968

Critical

2026-11-02

Not applicable

No public exploit

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-20582

Medium

2026-11-02

Not applicable

No public exploit

In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.

CVE-2026-20573

Medium

2026-11-02

Not applicable

No public exploit

In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.

CVE-2026-119338

Medium

2026-10-30

Not applicable

Proof of concept only

Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.

CVE-2026-119116

High

2026-10-30

Not applicable

No public exploit

A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.

CVE-2026-85890

High

2026-10-29

Not applicable

No public exploit

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-88812

High

2026-10-27

Not applicable

No public exploit

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVE-2026-83831

High

2026-10-27

Not applicable

No public exploit

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-117943

High

2026-10-27

Not applicable

No public exploit

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-116743

Medium

2026-10-26

Not applicable

Proof of concept only

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.

CVE-2026-116260

Medium

2026-10-26

Not applicable

Proof of concept only

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-112457

High

2026-10-26

Not applicable

No public exploit

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.

CVE-2026-112410

High

2026-10-26

Not applicable

No public exploit

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may cause an unexpected process termination.

CVE-2026-94300

High

2026-10-21

Not applicable

No public exploit

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVE-2026-78116

Medium

2026-10-21

Not applicable

No public exploit

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_error_on_result(), which finalises the request with rtio_iodev_sqe_err(), but execution then fell through to the tail of the function and finalised the very same struct rtio_iodev_sqe a second time with rtio_iodev_sqe_ok(). Unlike the other error branches in the same function, this one did not return. Both completion helpers reach rtio_executor_done() in subsys/rtio/rtio_executor.c, which returns the submission to the pool via rtio_sqe_pool_free() and, for streaming (multishot) submissions, also releases the RX buffer with rtio_release_buffer(). The second completion therefore reads a freed rtio_iodev_sqe, pushes the same mpsc node onto the submission queue while it is already on the pool free list — splicing the two lists together — and re-submits the freed request so the next measurement is written through an already-released buffer. For one-shot submissions it emits a spurious success completion carrying stale userdata and frees the same pool entry twice. The failure branch is driven by sensor conditions rather than by host software. The vendor API documents statuses such as ERROR_ARGUS_BIAS_VOLTAGE_REINIT and ERROR_ARGUS_LASER_MONITOR_INACTIVE as transient results of harsh ambient light, so a party in front of the optical sensor can provoke the invalid-data condition without any physical contact with the board or any software access; SPI transfer errors reach the same branch. In releases before the payload.Status check was dropped, ordinary sharp distance transitions in the sensor's field of view were sufficient. Impact is corruption of the RTIO submission pool and mempool bookkeeping: aliased submissions, writes through released buffers, and duplicate completions delivered to the application. The attacker does not control the corrupted content, so the practical consequence is memory corruption and loss of availability on devices that instantiate brcm,afbr-s50, rather than directed code execution. Only builds that enable this driver are affected.

CVE-2026-86962

Medium

2026-10-20

Not applicable

No public exploit

A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-112036

Low

2026-10-19

Not applicable

Proof of concept only

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

CVE-2026-57446

Medium

2026-10-16

Not applicable

Proof of concept only

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

CVE-2026-94370

Medium

2026-10-14

Not applicable

No public exploit

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

CVE-2026-110599

Medium

2026-10-14

Not applicable

Proof of concept only

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

CVE-2026-97830

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

CVE-2026-97812

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

CVE-2026-97811

High

2026-10-13

Not applicable

No public exploit

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

CVE-2026-97772

High

2026-10-13

Not applicable

No public exploit

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-97767

High

2026-10-13

Not applicable

No public exploit

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-97749

Critical

2026-10-13

Not applicable

No public exploit

Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

CVE-2026-96864

Critical

2026-10-13

Not applicable

No public exploit

Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.

CVE-2026-95943

High

2026-10-13

Not applicable

No public exploit

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

CVE-2026-95635

High

2026-10-13

Not applicable

No public exploit

Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-88171

High

2026-10-13

Not applicable

No public exploit

Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVE-2026-88149

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-88071

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-85936

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Shell allows an unauthorized attacker to execute code over a network.

CVE-2026-85904

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85829

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.

CVE-2026-84012

High

2026-10-13

Not applicable

No public exploit

Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

CVE-2026-83916

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

CVE-2026-83842

High

2026-10-13

Not applicable

No public exploit

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVE-2026-83634

High

2026-10-13

Not applicable

No public exploit

Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVE-2026-70158

High

2026-10-13

Not applicable

No public exploit

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

CVE-2026-70062

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.

CVE-2026-109943

High

2026-10-13

Not applicable

Proof of concept only

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.

CVE-2026-108132

High

2026-10-13

Not applicable

No public exploit

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

CVE-2026-106175

Low

2026-10-13

Not applicable

No public exploit

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.

CVE-2026-104192

Critical

2026-10-13

Not applicable

No public exploit

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

CVE-2026-109271

Medium

2026-10-12

Not applicable

No public exploit

ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.

CVE-2026-109257

High

2026-10-12

Not applicable

Proof of concept only

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

CVE-2026-95702

High

2026-10-09

Not applicable

No public exploit

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.

CVE-2026-5759

Critical

2026-10-09

Not applicable

No public exploit

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.

CVE-2026-108104

Medium

2026-10-09

Not applicable

No public exploit

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.

CVE-2026-107886

Medium

2026-10-09

Not applicable

Proof of concept only

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.

CVE-2026-104113

Medium

2026-10-09

Not applicable

No public exploit

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

CVE-2026-107209

High

2026-10-07

Not applicable

No public exploit

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVE-2026-20532

Medium

2026-10-05

Not applicable

No public exploit

In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168.

CVE-2026-47558

High

2026-09-30

Not applicable

No public exploit

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVE-2026-98154

High

2026-09-25

Not applicable

No public exploit

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.

CVE-2026-89078

Critical

2026-09-24

Not applicable

No public exploit

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

CVE-2026-6794

High

2026-09-23

Not applicable

No public exploit

IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.

CVE-2026-91018

High

2026-09-22

Not applicable

No public exploit

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

CVE-2026-11388

Medium

2026-09-22

Not applicable

No public exploit

Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.