CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2026-10932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:16:55Z",
    "severity": "HIGH"
  },
  "details": "Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-v4qh-wp8v-x2xq",
  "modified": "2026-06-05T03:31:31Z",
  "published": "2026-06-05T00:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10932"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/501335606"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-08T09:16:29Z",
    "severity": "HIGH"
  },
  "details": "Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.",
  "id": "GHSA-v4qp-8g92-cj69",
  "modified": "2026-07-08T09:31:48Z",
  "published": "2026-07-08T09:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13128"
    },
    {
      "type": "WEB",
      "url": "https://www.foxit.com/support/security-bulletins.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-6653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-22T14:17:51Z",
    "severity": "HIGH"
  },
  "details": "Use After Free in libxml2\u0027s xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.",
  "id": "GHSA-v4qw-p44r-qhfg",
  "modified": "2026-07-14T18:31:47Z",
  "published": "2026-06-22T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-50245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T14:15:34Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible UAF when kfifo_alloc() fails\n\nIf kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free\npriv. But priv is still in the chdev-\u003efile_list, then list traversal\nmay cause UAF. This fixes the following smatch warning:\n\ndrivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: \u0027\u0026priv-\u003elist\u0027 not removed from list",
  "id": "GHSA-v4vx-qxh4-8ww4",
  "modified": "2025-11-24T21:30:56Z",
  "published": "2025-09-15T15:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50245"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/02d7d89f816951e0862147d751b1150d67aaebdd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2a6c75adf8192f07ddcdd4a1a13488c890a73919"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ba06e57f933f0eac242e8b389433da1cc00d4d5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2dfd60724d271a6ab99f93f40f38f2ced1ddbb87"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2f5cc7fd73fd6253cc71214f0dd499cc62feb469"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/311b488405ac45af46756b1c8f1d27007b68b07e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5ee850645e42f541ce1ea8130c2b27cc495f965c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a253dde0403a153075ffb254f6f7b2635e49e97a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb87af2c19c0993f6e21f75b963a5599c5a73e76"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-26T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.",
  "id": "GHSA-v52h-39q4-ccvw",
  "modified": "2022-07-29T00:00:30Z",
  "published": "2022-07-27T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1633"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1316990"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-23454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-03T16:16:31Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc-\u003ecaller_ctx is freed before the HWC\u0027s Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -\u003e mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc-\u003ecaller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq-\u003emsg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc-\u003ecaller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.",
  "id": "GHSA-v535-7p5c-7xm9",
  "modified": "2026-07-14T15:31:46Z",
  "published": "2026-04-03T18:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23454"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6df"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-38437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-14T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-v536-r24f-xv5h",
  "modified": "2022-10-15T12:01:01Z",
  "published": "2022-10-15T12:01:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38437"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb22-46.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:16:58Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-v54j-r4vm-9pcv",
  "modified": "2026-06-05T03:31:32Z",
  "published": "2026-06-05T00:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10953"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/506147564"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14178"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T14:16:25Z",
    "severity": "MODERATE"
  },
  "details": "openGauss \u5728\u5904\u7406\u5e26 NLS \u53c2\u6570\u7684 to_timestamp \u8c03\u7528\u65f6\uff0cto_timestamp_with_fmt_nls() \u4f1a\u5c06 nls_fmt_str \u4fdd\u5b58\u5230 u_sess-\u003eparser_cxt.nls_fmt_str\u3002\u5728 seqscan + sort \u6267\u884c\u8def\u5f84\u4e0b\uff0c\u8be5\u5b57\u7b26\u4e32\u539f\u672c\u88ab\u5206\u914d\u5728 SeqScan \u7684\u8868\u8fbe\u5f0f\u4e0a\u4e0b\u6587\u4e2d\uff1b\u5f53 SeqScan \u5b8c\u6210\u540e\uff0c\u8be5\u5185\u5b58\u4e0a\u4e0b\u6587\u4f1a\u88ab reset\uff0c\u4f46\u540e\u7eed\u7ed3\u679c\u8f93\u51fa\u9636\u6bb5 timestamp_out() \u4ecd\u4f1a\u901a\u8fc7 CheckNlsFormat() \u8bbf\u95ee u_sess-\u003eparser_cxt.nls_fmt_str\uff0c\u5bfc\u81f4\u8bbf\u95ee\u5df2\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u5728\u5177\u5907\u6570\u636e\u5e93 SQL \u6267\u884c\u6743\u9650\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u6784\u9020\u7279\u5b9a to_timestamp(..., ..., nlsparam) \u67e5\u8be2\u89e6\u53d1 heap-use-after-free\u3002\u5728 ASan/Memcheck \u73af\u5883\u4e0b\u8868\u73b0\u4e3a\u6570\u636e\u5e93\u670d\u52a1\u9000\u51fa\uff1b\u5728\u5b9e\u9645\u8fd0\u884c\u73af\u5883\u4e2d\u53ef\u80fd\u9020\u6210\u540e\u7aef\u8fdb\u7a0b\u5f02\u5e38\u9000\u51fa\uff0c\u5f71\u54cd\u6570\u636e\u5e93\u670d\u52a1\u53ef\u7528\u6027\uff0c\u5f62\u6210\u62d2\u7edd\u670d\u52a1\u98ce\u9669\u3002\u8be5\u95ee\u9898\u5728openGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u7248\u672c\u5b58\u5728\uff0c\u76ee\u524d\u5df2\u5728openGauss-server-7.0.0-RC3\u7248\u672c\u4fee\u590d\u3002\u7531\u4e8e\nopenGauss-server-7.0.0-RC1\u7248\u672c\u548copenGauss-server-7.0.0-RC2\u5747\u4e3a\u521b\u65b0\u7248\u672c\uff0c\u4e0d\u4f1a\u53d1\u5e03\u9488\u5bf9\u6027\u8865\u4e01\u5305\uff0c\u6d89\u53ca\u7248\u672c\u5347\u7ea7\u81f3\nopenGauss-server-7.0.0-RC3\u6216\u66f4\u65b0\u7248\u672c\u5373\u53ef\u3002",
  "id": "GHSA-v555-5g3c-vq2x",
  "modified": "2026-06-30T15:30:46Z",
  "published": "2026-06-30T15:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14178"
    },
    {
      "type": "WEB",
      "url": "https://gitcode.com/opengauss/openGauss-server/pull/8877"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-5171"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-27T15:19:42Z",
    "severity": "MODERATE"
  },
  "details": "During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
  "id": "GHSA-v567-j6g5-phvx",
  "modified": "2024-04-04T07:55:55Z",
  "published": "2023-09-27T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5171"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1851599"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5506"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5513"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-41"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-42"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-43"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}