Meta Proxygen CVE-2026-91096

Requires the target to be a proxygen-based server (or peer) with WebTransport over HTTP/3 in use - WebTransport is a non-ubiquitous, relatively new feature, which materially limits the exposed attack surface. The attacker must be able to open WebTransport streams and drive the session into the teardown path where streams are closed while a read callback is still registered, so exploitation hinges on reaching the specific stream-lifetime/teardown sequence rather than a single trivial request. Per the CVSS vector this is remote and unauthenticated (PR:N, UI:N), but reliability depends on stream-state timing and the deployment actually enabling WebTransport; deployments not using WebTransport are unaffected.

This is a CWE-416 use-after-free in Meta's proxygen HTTP library, affecting WebTransport session teardown (WebTransportImpl::terminateSessionStreams, formerly ::destroy) where read callbacks for no-longer-open streams are not unregistered before being freed, allowing the transport to later invoke a freed callback. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) implies remote unauthenticated triggering with high confidentiality impact, consistent with the 'Information Disclosure' tag. However, the real-world signals point to modest priority: EPSS is very low at 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and no public POC is identified. The vulnerability was self-reported by Meta with a vendor advisory and a fix commit, indicating responsible-disclosure hygiene rather than observed attacks. IMPORTANT DATA CONFLICT: the linked fix commit (479eb557) modifies HTTPBinaryCodec.cpp (Binary HTTP / field-section parsing), which does not correspond to the described WebTransportImpl read-callback defect - the referenced diff appears to be a different change than the one the description narrates, so the exact patch for this UAF cannot be independently confirmed from the provided evidence. Additionally, use-after-free on a read callback most plausibly causes a crash (availability) or leaks freed-memory contents, so the vendor's choice of C:H/A:N is questionable; a crash-based DoS (A:H) is at least as likely as reliable information disclosure. Net: a real, patchable memory-safety bug but low probability of widespread exploitation given niche feature (WebTransport) and no exploitation signals.

A remote client establishes an HTTP/3 WebTransport session against a proxygen-based server and opens streams, then drives the session into a teardown path where some streams are no longer open while a read callback remains registered. When the session's stream state is destroyed, the transport invokes the freed read callback, corrupting memory to crash the process or potentially disclose freed-memory contents. No public exploit code is identified at time of analysis, and successful exploitation depends on winning the specific stream-lifetime timing.