VulnSea

CWE-415

CVEs classified under CWE-415, newest first.

91 CVEsRSS

CVE-2026-20510Medium· 6.7
2w ago

In camera middleware, there is a possible escalation of privilege due to double free

In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exp…

SunlitMediaTek, Inc. · MediaTek chipsetEPSS 0.12%via NVD
CVE-2026-33630High· 7.5
2w ago

c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channe…

TwilightEPSS 0.45%via NVD
CVE-2026-52023High· 7.5
2w ago

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_s…

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_s…

Twilightkamailio · kamailioEPSS 0.33%via NVD
CVE-2026-47895High· 7.5
1mo ago

In strongSwan before 6.0.7, identity parsing/cloning is mishandled

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

TwilightEPSS 0.67%via NVD
CVE-2026-63652Medium· 6.5
1mo ago

FreeRDP is a free implementation of the Remote Desktop Protocol

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing t…

SunlitRed Hat · Red Hat Enterprise Linux AppStream (v. 10)EPSS 0.34%via NVD
CVE-2026-62766High· 7.0
1mo ago

Windows Kerberos Elevation of Privilege Vulnerability

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

TwilightMicrosoft · Windows 11 Version 24H2EPSS 1.5%via CVEORG
CVE-2026-62889High· 8.1
1mo ago

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

TwilightMicrosoft · Windows 10 Version 1607EPSS 0.56%via CVEORG
CVE-2026-65780High· 7.0
1mo ago

Windows Autopilot Elevation of Privilege Vulnerability

Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

TwilightMicrosoft · Windows 11 Version 24H2EPSS 0.20%via CVEORG
CVE-2026-61366High· 7.0
1mo ago

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

Twilightmicrosoft · windows_10_1607EPSS 0.25%via NVD
CVE-2026-43622High· 7.8
1mo ago

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap m…

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap m…

Twilightggml · llama.cppEPSS 0.16%via NVD
CVE-2026-64597Critical· 9.8⚖ disputed
1mo ago

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails b…

MidnightRed Hat · Red Hat Enterprise Linux BaseOS (v. 10)EPSS 0.36%via NVD
CVE-2026-66373High· 7.5
1mo ago

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…

TwilightRed Hat · Red Hat Enterprise Linux AppStream (v. 9)EPSS 0.56%via NVD
CVE-2026-64377High· 7.8
1mo ago

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_in…

Twilightlinux · linux_kernelEPSS 0.13%via NVD
CVE-2026-64387Critical· 9.8⚖ disputed
1mo ago

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init…

Midnightlinux · linux_kernelEPSS 0.46%via NVD
CVE-2026-43823High· 7.5
2mo ago

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests whe…

Twilightapple · swift-cryptoEPSS 0.26%via NVD
CVE-2026-55004High· 7.8
2mo ago

Windows Print Configuration Elevation of Privilege Vulnerability

Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

TwilightMicrosoft · Windows 10 Version 1607EPSS 0.33%via CVEORG
CVE-2026-50361High· 7.8
2mo ago

Microsoft Brokering File System Elevation of Privilege Vulnerability

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

TwilightMicrosoft · Windows 11 Version 24H2EPSS 0.26%via CVEORG
CVE-2026-50685High· 7.5
2mo ago

Windows DHCP Server Remote Code Execution Vulnerability

Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.

TwilightMicrosoft · Windows 10 Version 1607EPSS 0.66%via CVEORG
CVE-2026-55132High· 7.8
2mo ago

Microsoft Word Remote Code Execution Vulnerability

Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

TwilightMicrosoft · Microsoft 365 Apps for EnterpriseEPSS 0.57%via CVEORG
CVE-2026-14604Medium· 6.3
2mo ago

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation cau…

SunlitEPSS 0.40%via NVD
CVE-2026-8925Critical· 9.8PoC
2mo ago

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

Abyssalhaxx · curlEPSS 0.67%via NVD
CVE-2026-14164High· 7.5PoC
2mo ago

A double free issue has been identified in libarchive's RAR5 reader

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent proc…

MidnightRed Hat · libarchiveEPSS 0.49%via NVD
CVE-2026-10653Medium· 6.4
2mo ago

The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (…

The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (…

Sunlitzephyrproject · zephyrEPSS 0.42%via NVD
CVE-2026-53322High· 8.8
2mo ago

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disab…

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disab…

Twilightlinux · linux_kernelEPSS 0.13%via NVD
CVE-2026-53009High· 7.8
2mo ago

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it…

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it…

Twilightlinux · linux_kernelEPSS 0.14%via NVD
CVE-2026-55653Medium· 4.3
3mo ago

A flaw was found in OpenSSH

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group va…

Sunlitopenbsd · opensshEPSS 0.30%via NVD
CVE-2026-11576High· 7.5
3mo ago

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file …

Twilighteclipse · threadx_netx_duoEPSS 0.46%via NVD
CVE-2026-44422High· 7.5
3mo ago

FreeRDP is a free implementation of the Remote Desktop Protocol

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR …

Twilightfreerdp · freerdpEPSS 0.43%via NVD
CVE-2026-46189High· 7.8
3mo ago

In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so…

In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so…

Twilightlinux · linux_kernelEPSS 0.14%via NVD
CVE-2026-45852High· 7.8
3mo ago

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space…

Twilightlinux · linux_kernelEPSS 0.18%via NVD
CWE-415 vulnerabilities (CVEs) — page 2 · VulnSea