Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
12251 vulnerabilities reference this CWE, most recent first.
CVE-2026-119378 (GCVE-0-2026-119378)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
Summary
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://sqlite.org/src/info/6a9e1415659f9e75 | patch |
| https://github.com/sqlite/sqlite/commit/d21bd37c7… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-rtree-rowid0 | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:53.674733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:16.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_RTREE (or SQLITE_ENABLE_GEOPOLY) is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude and Ada Logics"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-09-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:42.626Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/6a9e1415659f9e75"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-rtree-rowid0"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119378",
"datePublished": "2026-10-30T11:30:42.626Z",
"dateReserved": "2026-10-30T00:57:06.311Z",
"dateUpdated": "2026-10-30T15:56:16.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119372 (GCVE-0-2026-119372)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
Summary
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Severity
5.5 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-17T09:18:24Z | issue-tracking |
| https://sqlite.org/src/info/e4635c4153 | patch |
| https://github.com/sqlite/sqlite/commit/a87bd2471… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts3-snippet | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc Heuse"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:38.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/e4635c4153"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119372",
"datePublished": "2026-10-30T11:30:38.453Z",
"dateReserved": "2026-10-30T00:39:32.365Z",
"dateUpdated": "2026-10-30T11:30:38.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119338 (GCVE-0-2026-119338)
Vulnerability from cvelistv5 – Published: 2026-10-30 20:12 – Updated: 2026-10-30 20:12
VLAI
EPSS
VEX
Title
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Summary
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tesseract-ocr/tesseract/securi… | x_refsource_CONFIRM |
| https://github.com/tesseract-ocr/tesseract/pull/4647 | x_refsource_MISC |
| https://github.com/tesseract-ocr/tesseract/commit… | x_refsource_MISC |
| https://github.com/tesseract-ocr/tesseract/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tesseract-ocr | tesseract |
Affected:
>= 5.4.0, < 5.5.4
|
{
"containers": {
"cna": {
"affected": [
{
"product": "tesseract",
"vendor": "tesseract-ocr",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.4.0, \u003c 5.5.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415: Double Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:12:29.030Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"
},
{
"name": "https://github.com/tesseract-ocr/tesseract/pull/4647",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tesseract-ocr/tesseract/pull/4647"
},
{
"name": "https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb"
},
{
"name": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"
}
],
"source": {
"advisory": "GHSA-vf7v-2h4f-6f4j",
"discovery": "UNKNOWN"
},
"title": "Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119338",
"datePublished": "2026-10-30T20:12:29.030Z",
"dateReserved": "2026-10-29T20:44:30.286Z",
"dateUpdated": "2026-10-30T20:12:29.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119332 (GCVE-0-2026-119332)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:57 – Updated: 2026-10-30 19:57
VLAI
EPSS
VEX
Title
Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()
Summary
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.
Severity
8.8 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/LadybirdBrowser/ladybird/secur… | x_refsource_CONFIRM |
| https://github.com/LadybirdBrowser/ladybird/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LadybirdBrowser | ladybird |
Affected:
< 209579c96473c75bd5eba9701fcadb841a045964
|
{
"containers": {
"cna": {
"affected": [
{
"product": "ladybird",
"vendor": "LadybirdBrowser",
"versions": [
{
"status": "affected",
"version": "\u003c 209579c96473c75bd5eba9701fcadb841a045964"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:57:47.291Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph"
},
{
"name": "https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964"
}
],
"source": {
"advisory": "GHSA-6cmv-xmff-qjph",
"discovery": "UNKNOWN"
},
"title": "Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119332",
"datePublished": "2026-10-30T19:57:47.291Z",
"dateReserved": "2026-10-29T20:44:30.285Z",
"dateUpdated": "2026-10-30T19:57:47.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119116 (GCVE-0-2026-119116)
Vulnerability from cvelistv5 – Published: 2026-10-30 16:10 – Updated: 2026-10-30 20:00
VLAI
EPSS
VEX
Title
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
Summary
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave.
To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 19:21 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/aws/aws-nitro-enclaves-sdk-c/r… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/aws/aws-nitro-enclaves-sdk-c/s… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | kmstool-enclave |
Affected:
0 , < 0.4.6
(custom)
cpe:2.3:a:aws:kmstool-enclave:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T19:21:57.096116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:00:57.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kmstool-enclave",
"vendor": "AWS",
"versions": [
{
"lessThan": "0.4.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:kmstool-enclave:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.4.6",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should rebuild any enclave image that includes \u003ccode\u003ekmstool-enclave\u003c/code\u003e, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.\u003c/p\u003e"
}
],
"value": "A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave.\n\n\n\nTo remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:21:02.630Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/aws/aws-nitro-enclaves-sdk-c/releases/tag/v0.4.6"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-157-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/aws/aws-nitro-enclaves-sdk-c/security/advisories/GHSA-cfhm-qfw4-j7qq"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-119116",
"datePublished": "2026-10-30T16:10:39.338Z",
"dateReserved": "2026-10-29T14:19:52.182Z",
"dateUpdated": "2026-10-30T20:00:57.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116540 (GCVE-0-2026-116540)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:59 – Updated: 2026-10-26 16:15
VLAI
EPSS
VEX
Title
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
Summary
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:38 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/netty/netty-tcnative/security/… | vendor-advisory |
| https://github.com/netty/netty-tcnative/commit/59… | patch |
| https://github.com/netty/netty-tcnative/blob/nett… | technical-description |
| https://github.com/netty/netty-tcnative/releases/… | release-notes |
| https://github.com/netty/netty-tcnative | product |
| https://www.vulncheck.com/advisories/netty-tcnati… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| netty | netty-tcnative |
Affected:
2.0.66.Final , < 2.0.84.Final
(custom)
|
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:38:07.789293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:15:16.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative/",
"defaultStatus": "unaffected",
"packageName": "io.netty:netty-tcnative",
"packageURL": "pkg:maven/io.netty/netty-tcnative",
"product": "netty-tcnative",
"repo": "https://github.com/netty/netty-tcnative",
"vendor": "netty",
"versions": [
{
"lessThan": "2.0.84.Final",
"status": "affected",
"version": "2.0.66.Final",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:59:40.154Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mmc8-vg2v-fvvw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365"
},
{
"name": "netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final"
},
{
"tags": [
"product"
],
"url": "https://github.com/netty/netty-tcnative"
},
{
"name": "VulnCheck Advisory: netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback"
}
],
"title": "netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116540",
"datePublished": "2026-10-26T14:59:40.154Z",
"dateReserved": "2026-10-26T14:30:57.662Z",
"dateUpdated": "2026-10-26T16:15:16.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115379 (GCVE-0-2026-115379)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:13 – Updated: 2026-10-22 19:13
VLAI
EPSS
VEX
Title
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
Summary
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
Severity
5.7 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bytecodealliance/wasmtime/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/wasmtime-47.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bytecodealliance | wasmtime |
Affected:
47.0.0 , < 48.0.4
(semver)
Unaffected: 48.0.4 (semver) Affected: 49.0.0 , < 49.0.2 (semver) Unaffected: 49.0.2 (semver) cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* |
Date Public
2026-10-02 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/wasmtime",
"product": "wasmtime",
"vendor": "bytecodealliance",
"versions": [
{
"lessThan": "48.0.4",
"status": "affected",
"version": "47.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "48.0.4",
"versionType": "semver"
},
{
"lessThan": "49.0.2",
"status": "affected",
"version": "49.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "49.0.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "48.0.4",
"versionStartIncluding": "47.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "49.0.2",
"versionStartIncluding": "49.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:13:47.737Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hw8m-q44c-ggrf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf"
},
{
"name": "VulnCheck Advisory: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-try-call"
}
],
"title": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115379",
"datePublished": "2026-10-22T19:13:47.737Z",
"dateReserved": "2026-10-22T11:25:27.610Z",
"dateUpdated": "2026-10-22T19:13:47.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114111 (GCVE-0-2026-114111)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-28 13:49
VLAI
EPSS
VEX
Title
Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
Summary
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 13:49 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lovell/sharp/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/sharp-before… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T13:49:33.729115Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T13:49:52.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/sharp",
"product": "sharp",
"vendor": "lovell",
"versions": [
{
"lessThan": "0.35.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.35.5",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:37:10.362Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wq5f-xc86-pv6w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w"
},
{
"name": "VulnCheck Advisory: Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability"
}
],
"title": "Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114111",
"datePublished": "2026-10-21T00:37:10.362Z",
"dateReserved": "2026-10-20T21:48:58.503Z",
"dateUpdated": "2026-10-28T13:49:52.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114042 (GCVE-0-2026-114042)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-22 18:23
VLAI
EPSS
VEX
Title
FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
Summary
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 18:22 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-3.32… | third-party-advisory |
Impacted products
Date Public
2026-10-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114042",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T18:22:53.979656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T18:23:03.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5xjc-c64q-m8r6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.1",
"status": "affected",
"version": "3.32.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.1",
"versionStartIncluding": "3.32.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael-JRead"
}
],
"datePublic": "2026-10-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:22.092Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5xjc-c64q-m8r6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5xjc-c64q-m8r6"
},
{
"name": "VulnCheck Advisory: FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-3.32.0-use-after-free-via-drdynvc-virtual-channel-pdu"
}
],
"title": "FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114042",
"datePublished": "2026-10-21T00:36:22.092Z",
"dateReserved": "2026-10-20T21:41:06.179Z",
"dateUpdated": "2026-10-22T18:23:03.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112402 (GCVE-0-2026-112402)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:18 – Updated: 2026-10-19 21:37
VLAI
EPSS
VEX
Title
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Summary
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:37 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/aa… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
< 13.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112402",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:37:14.144311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:37:35.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:18:57.027Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-7mwm-ghpf-9vrm",
"discovery": "UNKNOWN"
},
"title": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112402",
"datePublished": "2026-10-19T21:18:57.027Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-19T21:37:35.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.