CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2026-42985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T17:17:14Z",
    "severity": "HIGH"
  },
  "details": "Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.",
  "id": "GHSA-c52c-3v9x-965h",
  "modified": "2026-06-09T18:30:46Z",
  "published": "2026-06-09T18:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42985"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-52976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T17:17:08Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\n   to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\n   preempt fence mode, xe_vm_add_compute_exec_queue() has already added\n   the queue to the VM\u0027s compute exec queue list. Skipping the kill\n   leaves the queue on that list, leading to a dangling pointer after\n   the queue is freed.\n\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\n   succeeded, the error path does not call\n   xe_hw_engine_group_del_exec_queue() to remove the queue from the hw\n   engine group list. The queue is then freed while still linked into\n   the hw engine group, causing a use-after-free.\n\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\n  to kill_exec_queue so that xe_exec_queue_kill() properly removes the\n  queue from the VM\u0027s compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\n  xa_alloc() failure path, which removes the queue from the hw engine\n  group before proceeding with the rest of the cleanup.\n\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)",
  "id": "GHSA-c52j-4pg6-8f2f",
  "modified": "2026-07-22T12:32:12Z",
  "published": "2026-06-24T18:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52976"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:42919"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-52976"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492284"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52976.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-2293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-25T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Pointer dereference while freeing IFE resources due to lack of length check of in port resource. in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24",
  "id": "GHSA-c54h-299w-6cc2",
  "modified": "2024-04-04T01:22:29Z",
  "published": "2022-05-24T16:51:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2293"
    },
    {
      "type": "WEB",
      "url": "https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-47078"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-01T22:15:47Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Clear all QP fields if creation failed\n\nrxe_qp_do_cleanup() relies on valid pointer values in QP for the properly\ncreated ones, but in case rxe_qp_from_init() failed it was filled with\ngarbage and caused tot the following error.\n\n  refcount_t: underflow; use-after-free.\n  WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Modules linked in:\n  CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 \u003c0f\u003e 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55\n  RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000\n  R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800\n  R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000\n  FS:  00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   __refcount_sub_and_test include/linux/refcount.h:283 [inline]\n   __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n   refcount_dec_and_test include/linux/refcount.h:333 [inline]\n   kref_put include/linux/kref.h:64 [inline]\n   rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805\n   execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327\n   rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391\n   kref_put include/linux/kref.h:65 [inline]\n   rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425\n   _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline]\n   ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231\n   ib_create_qp include/rdma/ib_verbs.h:3644 [inline]\n   create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920\n   ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline]\n   ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092\n   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717\n   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331\n   ib_register_device drivers/infiniband/core/device.c:1413 [inline]\n   ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365\n   rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147\n   rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247\n   rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503\n   rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline]\n   rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250\n   nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555\n   rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195\n   rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n   rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259\n   netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n   netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n   netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n   sock_sendmsg_nosec net/socket.c:654 [inline]\n   sock_sendmsg+0xcf/0x120 net/socket.c:674\n   ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n   ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n   __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n   do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47\n   entry_SYSCALL_64_after_hwframe+0\n---truncated---",
  "id": "GHSA-c56c-8vvg-gr68",
  "modified": "2024-11-01T09:30:44Z",
  "published": "2024-03-02T00:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47078"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/03344e843ab6dd3b3f2cadfb65ed910590856c70"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ee4d79c364914989c80de382c0b1a7259a7e4b3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/67f29896fdc83298eed5a6576ff8f9873f709228"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a8086a42dfbf548a42bf2ae4faa291645c72c66"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a62225d951d77eb20208fed8fc199e0c9b1df08b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c65391dd9f0a47617e96e38bd27e277cbe1c40b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f3783c415bf6d2ead3d7aa2c38802bbe10723646"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-12780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-10T02:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted mkv file.",
  "id": "GHSA-c58v-vgcm-vhfg",
  "modified": "2022-05-17T00:22:00Z",
  "published": "2022-05-17T00:22:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12780"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Matroska-Org/foundation-source/issues/24"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2017/Nov/19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-17T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSimple_Calculate method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5491.",
  "id": "GHSA-c59w-hpfr-55m3",
  "modified": "2022-05-13T01:33:26Z",
  "published": "2022-05-13T01:33:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1180"
    },
    {
      "type": "WEB",
      "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
    },
    {
      "type": "WEB",
      "url": "https://zerodayinitiative.com/advisories/ZDI-18-318"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-4792"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-12-30T18:55:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.",
  "id": "GHSA-c5c8-vqpp-hm75",
  "modified": "2025-10-22T03:30:32Z",
  "published": "2022-05-13T01:15:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4792"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792"
    },
    {
      "type": "WEB",
      "url": "http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html"
    },
    {
      "type": "WEB",
      "url": "http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx"
    },
    {
      "type": "WEB",
      "url": "http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx"
    },
    {
      "type": "WEB",
      "url": "http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations"
    },
    {
      "type": "WEB",
      "url": "http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html"
    },
    {
      "type": "WEB",
      "url": "http://technet.microsoft.com/security/advisory/2794220"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/154201"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA13-008A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA13-015A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-47939"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-23T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in ksmbd in the Linux kernel before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.",
  "id": "GHSA-c5f7-v4rr-qv23",
  "modified": "2025-04-14T21:32:17Z",
  "published": "2022-12-23T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47939"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/commit/cf6531d98190fa2cf92a6d8bbc8af0a4740a223c"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf6531d98190fa2cf92a6d8bbc8af0a4740a223c"
    },
    {
      "type": "WEB",
      "url": "https://www.secpod.com/blog/zero-day-server-message-block-smb-server-in-linux-kernel-5-15-has-a-critical-vulnerability-patch-ksmbd-immediately"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1690"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/12/23/10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-42280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T09:15:08Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix a use after free in hfcmulti_tx()\n\nDon\u0027t dereference *sp after calling dev_kfree_skb(*sp).",
  "id": "GHSA-c5f9-wr82-c7qx",
  "modified": "2025-11-04T00:31:12Z",
  "published": "2024-08-17T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42280"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4d8b642985ae24f4b3656438eb8489834a17bb80"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61ab751451f5ebd0b98e02276a44e23a10110402"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/70db2c84631f50e02e6b32b543700699dd395803"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e4a539bca7d8d20f2c5d93c18cce8ef77cd78e0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f4030277dfb9dbe04fd78566b19931097c9d629"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9460ac3dd1ae033bc2b021a458fb535a0c36ddb2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3e4d4a98c5629ccdcb762a0ff6c82ba9738a0c3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ddc79556641ee070d36be0de4a1f0a16a71f1fc7"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-2786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-24T14:16:27Z",
    "severity": "CRITICAL"
  },
  "details": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148 and Firefox ESR \u003c 140.8.",
  "id": "GHSA-c5fj-xq9f-fjxm",
  "modified": "2026-02-25T18:31:35Z",
  "published": "2026-02-24T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2786"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013612"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-13"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-15"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-16"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}