Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
3573 vulnerabilities reference this CWE, most recent first.
CVE-2026-95620 (GCVE-0-2026-95620)
Vulnerability from cvelistv5 – Published: 2026-10-23 10:56 – Updated: 2026-11-02 15:21
VLAI
EPSS
VEX
Title
Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt
Summary
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 15:19 UTC
CWE
- CWE-416 - Use After Free
Assigner
Qt
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | vendor-advisory |
| https://codereview.qt-project.org/c/qt/qtbase/+/759717 | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T15:19:20.519620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T15:21:58.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"qtbase"
],
"product": "qt",
"vendor": "qt",
"versions": [
{
"lessThan": "6.9.0",
"status": "unknown",
"version": "0",
"versionType": "python"
},
{
"lessThan": "6.11.3",
"status": "affected",
"version": "6.9.0",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.3",
"versionStartIncluding": "6.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Birtwhistle"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.\u003cbr\u003e"
}
],
"value": "A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability."
}
],
"impacts": [
{
"capecId": "CAPEC-220",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-220 Client-Server Protocol Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T10:56:15.281Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95620:"
},
{
"tags": [
"patch"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/759717"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-95620",
"datePublished": "2026-10-23T10:56:15.281Z",
"dateReserved": "2026-09-22T10:27:08.400Z",
"dateUpdated": "2026-11-02T15:21:58.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95391 (GCVE-0-2026-95391)
Vulnerability from cvelistv5 – Published: 2026-09-29 09:33 – Updated: 2026-09-29 15:39
VLAI
EPSS
VEX
Title
Use After Free in Wireshark
Summary
ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 12:42 UTC
CWE
- CWE-416 - Use After Free
Assigner
GitLab
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wireshark Foundation | Wireshark |
Affected:
4.6.0 , < 4.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T12:42:11.728266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:39:43.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"repo": "https://gitlab.com/wireshark/wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.9",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T09:33:43.016Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://www.wireshark.org/security/wnpa-sec-2026-92.html"
},
{
"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/26096"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 4.6.9 or above"
}
],
"title": "Use After Free in Wireshark"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-95391",
"datePublished": "2026-09-29T09:33:43.016Z",
"dateReserved": "2026-09-22T05:34:21.685Z",
"dateUpdated": "2026-09-29T15:39:43.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94453 (GCVE-0-2026-94453)
Vulnerability from cvelistv5 – Published: 2026-10-13 21:27 – Updated: 2026-10-16 15:31
VLAI
EPSS
VEX
Title
IKEv2 Use-After-Free bug when using IKE-over-TCP
Summary
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:14 UTC
CWE
- CWE-416 - Use After Free
Assigner
libreswan
CNA
References
2 references
| URL | Tags |
|---|---|
| https://libreswan.org/security/CVE-2026-94453/CVE… | vendor-advisory |
| https://libreswan.org/security/CVE-2026-94453/ | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| The Libreswan Project | libreswan |
Affected:
4.0 , ≤ 5.3.2
(semver)
Affected: 5.4 , ≤ 5.4 (semver) Unaffected: 5.3.3 (semver) Unaffected: 5.4.1 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:14:22.083231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:31:54.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/libreswan/libreswan",
"defaultStatus": "unaffected",
"packageName": "libreswan",
"product": "libreswan",
"repo": "https://github.com/libreswan/libreswan",
"vendor": "The Libreswan Project",
"versions": [
{
"lessThanOrEqual": "5.3.2",
"status": "affected",
"version": "4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4",
"status": "affected",
"version": "5.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.3.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.1",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Only configurations with listen-tcp=yes are vulnerable. IKE over TCP is not enabled by default in libreswan."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vlad Miu"
}
],
"descriptions": [
{
"lang": "en",
"value": "Libreswan\u0027s pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa-\u003est_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected."
}
],
"exploits": [
{
"lang": "en",
"value": "No known exploitation in the wild. Exploitation requires IKE over TCP to be enabled (listen-tcp=yes). The vulnerability can be triggered remotely without authentication."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Denial of service and potential remote code execution via use-after-free when processing IKE-over-TCP connections"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"description": "Vendor-assessed severity: High. Exploitation does not require authentication. IKE over TCP is not enabled by default but affects any configuration with listen-tcp=yes.",
"value": "HIGH"
},
"type": "vendorSeverity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T21:27:43.376Z",
"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"shortName": "libreswan"
},
"references": [
{
"name": "Libreswan Security Advisory CVE-2026-94453",
"tags": [
"vendor-advisory"
],
"url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"
},
{
"name": "Libreswan CVE-2026-94453 Patches",
"tags": [
"patch"
],
"url": "https://libreswan.org/security/CVE-2026-94453/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-94453/"
}
],
"source": {
"defects": [
"CVE-2026-94453"
],
"discovery": "EXTERNAL"
},
"taxonomyMappings": [
{
"taxonomyName": "ATT\u0026CK",
"taxonomyRelations": [
{
"relationshipName": "maps to",
"relationshipValue": "Application or System Exploitation (DoS)",
"taxonomyId": "T1499.004"
}
],
"taxonomyVersion": "15.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Libreswan was notified of the issue via security@libreswan.org"
},
{
"lang": "en",
"time": "2026-09-24T00:00:00.000Z",
"value": "Advanced notice given to supported customers and distributions"
},
{
"lang": "en",
"time": "2026-10-05T00:00:00.000Z",
"value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
}
],
"title": "IKEv2 Use-After-Free bug when using IKE-over-TCP",
"workarounds": [
{
"lang": "en",
"value": "To temporarily disable IKE over TCP, set listen-tcp=no."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"assignerShortName": "libreswan",
"cveId": "CVE-2026-94453",
"datePublished": "2026-10-13T21:27:43.376Z",
"dateReserved": "2026-09-21T17:09:02.116Z",
"dateUpdated": "2026-10-16T15:31:54.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94370 (GCVE-0-2026-94370)
Vulnerability from cvelistv5 – Published: 2026-10-14 05:43 – Updated: 2026-10-14 16:02
VLAI
EPSS
VEX
Title
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
Summary
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:02 UTC
CWE
Assigner
Qt
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | issue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| qt | Qt_for_MCUs |
Affected:
2.12.1 , < 2.12.3
(python)
cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:02:10.297104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:02:30.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"qul"
],
"product": "Qt_for_MCUs",
"vendor": "qt",
"versions": [
{
"lessThan": "2.12.3",
"status": "affected",
"version": "2.12.1",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.3",
"versionStartIncluding": "2.12.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public \u003ccode\u003eQul::String\u003c/code\u003e interface type, and that text is held in a \u003ccode\u003estd::string\u003c/code\u003e, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.\u003c/p\u003e"
}
],
"value": "A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:U/S:P/AU:N/R:U/V:D/RE:M",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-590",
"description": "CWE-590 Free of Memory not on the Heap",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T05:43:27.953Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-94370:"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-94370",
"datePublished": "2026-10-14T05:43:27.953Z",
"dateReserved": "2026-09-21T11:36:04.324Z",
"dateUpdated": "2026-10-14T16:02:30.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94192 (GCVE-0-2026-94192)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:15 – Updated: 2026-10-20 17:04
VLAI
EPSS
VEX
Title
Module object deallocation can free a live ThreadX kernel object
Summary
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:04 UTC
Assigner
eclipse
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX |
Affected:
6.0.1 , ≤ 6.5.1.202602a
(semver)
Unaffected: 6.5.2.202603 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:04:14.458746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:04:24.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ThreadX",
"product": "Eclipse ThreadX",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1.202602a",
"status": "affected",
"version": "6.0.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.5.2.202603"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "fdesbiens"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA ThreadX module allocates the control blocks of its kernel objects from the Module Manager\u0027s object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.\u003c/p\u003e"
}
],
"value": "A ThreadX module allocates the control blocks of its kernel objects from the Module Manager\u0027s object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "CWE-664 Improper Control of a Resource Through its Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:15:06.222Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-57mf-w87f-rq7m"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Module object deallocation can free a live ThreadX kernel object",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-94192",
"datePublished": "2026-10-20T15:15:06.222Z",
"dateReserved": "2026-09-23T13:42:24.290Z",
"dateUpdated": "2026-10-20T17:04:24.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94084 (GCVE-0-2026-94084)
Vulnerability from cvelistv5 – Published: 2026-09-20 01:20 – Updated: 2026-09-22 18:27
VLAI
EPSS
VEX
Summary
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:24 UTC
CWE
- CWE-416 - Use After Free
Assigner
mitre
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:24:29.351972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:27:33.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Suricata",
"vendor": "OISF",
"versions": [
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T01:20:20.503Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://forum.suricata.io/t/suricata-8-0-7-released/6467"
},
{
"url": "https://github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808"
},
{
"url": "https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94084",
"datePublished": "2026-09-20T01:20:20.503Z",
"dateReserved": "2026-09-20T01:20:20.153Z",
"dateUpdated": "2026-09-22T18:27:33.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94055 (GCVE-0-2026-94055)
Vulnerability from cvelistv5 – Published: 2026-09-19 22:48 – Updated: 2026-09-21 15:19
VLAI
EPSS
VEX
Summary
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:18 UTC
CWE
- CWE-416 - Use After Free
Assigner
mitre
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:18:50.531821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:19:07.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Exim",
"vendor": "Exim",
"versions": [
{
"lessThan": "4.100.1",
"status": "affected",
"version": "4.98",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.100.1",
"versionStartIncluding": "4.98",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T22:48:57.996Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94055",
"datePublished": "2026-09-19T22:48:57.996Z",
"dateReserved": "2026-09-19T22:48:57.608Z",
"dateUpdated": "2026-09-21T15:19:07.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93834 (GCVE-0-2026-93834)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:36 – Updated: 2026-11-05 00:12
VLAI
EPSS
VEX
Title
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
Summary
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:49 UTC
CWE
- CWE-416 - Use After Free
Assigner
redhat
CNA
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-93834 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2537939 | issue-trackingx_refsource_REDHAT |
| https://gitlab.com/qemu-project/qemu/-/work_items/4491 |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 |
cpe:/a:redhat:enterprise_linux_nvidia:
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 5 |
cpe:/a:redhat:openshift:5
|
|
| Red Hat | Red Hat OpenStack Platform 13 (Queens) |
cpe:/a:redhat:openstack:13
|
Date Public
2026-09-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93834",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:49:32.754375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:50:26.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gitlab.com/qemu-project/qemu/-/work_items/4491"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "unaffected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unaffected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unaffected",
"packageName": "qemu-kvm-ma",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "virt-devel:rhel/qemu-kvm",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "virt:rhel/qemu-kvm",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux for NVIDIA 26",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:5"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:13"
],
"defaultStatus": "unaffected",
"packageName": "qemu-kvm-rhev",
"product": "Red Hat OpenStack Platform 13 (Queens)",
"vendor": "Red Hat"
}
],
"datePublic": "2026-09-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability was found in QEMU\u0027s 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T00:12:18.099Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-93834"
},
{
"name": "RHBZ#2537939",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537939"
},
{
"url": "https://gitlab.com/qemu-project/qemu/-/work_items/4491"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape",
"workarounds": [
{
"lang": "en",
"value": "Do not configure 9pfs/VirtFS filesystem sharing (-fsdev, -virtfs) on affected QEMU instances. If host-guest file sharing is required, use virtio-fs (virtiofsd) as an alternative, which does not use the vulnerable 9pfs code path."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-416: Use After Free"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-93834",
"datePublished": "2026-09-25T13:36:17.597Z",
"dateReserved": "2026-09-18T18:12:23.908Z",
"dateUpdated": "2026-11-05T00:12:18.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93586 (GCVE-0-2026-93586)
Vulnerability from cvelistv5 – Published: 2026-09-18 13:20 – Updated: 2026-10-29 21:17
VLAI
EPSS
VEX
Title
ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob
Summary
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:05 UTC
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/imagemagick-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
7.0.0 , < 7.1.2-31
(semver)
Unaffected: 7.1.2-31 (semver) |
|
| ImageMagick | ImageMagick |
Affected:
0 , < 6.9.13-56
(semver)
Unaffected: 6.9.13-56 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:05:59.451482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:06:16.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "7.1.2-31",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.2-31",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "6.9.13-56",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.9.13-56",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-31",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.13-56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nosiume"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:17:10.554Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3rjr-534c-8v67)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67"
},
{
"name": "VulnCheck Advisory: ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-use-after-free-via-imagestoblob"
}
],
"title": "ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93586",
"datePublished": "2026-09-18T13:20:01.255Z",
"dateReserved": "2026-09-18T10:59:45.138Z",
"dateUpdated": "2026-10-29T21:17:10.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93516 (GCVE-0-2026-93516)
Vulnerability from cvelistv5 – Published: 2026-10-28 13:03 – Updated: 2026-11-06 18:33
VLAI
EPSS
VEX
Title
.Org Server XInput Passive Grab Use-After-Free
Summary
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:19 UTC
CWE
- CWE-416 - Use after free
Assigner
suse
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://gitlab.freedesktop.org/xorg/xserver/-/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| x.org | xorg-x11-server |
Affected:
0 , < 21.1.25
(rpm)
cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:* |
|
| x.org | xwayland |
Affected:
0 , < 24.1.14
(rpm)
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* |
Date Public
2026-10-28 12:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:19:38.591851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:33:56.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "xorg-x11-server",
"product": "xorg-x11-server",
"repo": "https://gitlab.freedesktop.org/xorg/xserver",
"vendor": "x.org",
"versions": [
{
"lessThan": "21.1.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "xwayland",
"product": "xwayland",
"repo": "https://gitlab.freedesktop.org/xorg/xserver",
"vendor": "x.org",
"versions": [
{
"lessThan": "24.1.14",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "21.1.25",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionEndExcluding": "24.1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Anonymous working with TrendAI Zero Day Initiative"
}
],
"datePublic": "2026-10-28T12:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context."
}
],
"value": "A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context."
}
],
"impacts": [
{
"capecId": "CAPEC-251",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-251 Local Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T13:03:30.088Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/be572634158850fff4e9829cee88db08d30c9743"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": ".Org Server XInput Passive Grab Use-After-Free",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93516",
"datePublished": "2026-10-28T13:03:30.088Z",
"dateReserved": "2026-09-18T08:46:56.692Z",
"dateUpdated": "2026-11-06T18:33:56.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.