Monthly
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
Kernel heap corruption and GPU memory leaks in Imagination Technologies Graphics DDK expose systems to local denial-of-service from non-privileged users. A double-free defect in the GPU memory free paths - triggered via user-initiated GPU system calls - can corrupt kernel heap state or cause memory leaks, with potential availability impact at the kernel level. No active exploitation is confirmed (EPSS 0.15%, no CISA KEV listing), but a vendor patch is available and a ChromeOS stable channel advisory confirms real-world distribution reach.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Windows Autopilot on Windows 11 versions 24H2, 25H2, and 26H1 contains a double-free memory corruption flaw that allows a locally authenticated, low-privileged attacker to escalate to full system privileges. The vulnerability carries a CVSS 3.1 score of 7.0 with high attack complexity (AC:H), meaning reliable exploitation requires specific conditions or timing to be met rather than being trivially reproducible. A vendor-released patch is available via the Microsoft Security Response Center, and no public exploit has been identified at time of analysis.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation via a double-free memory corruption flaw in the Windows Kerberos implementation affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A low-privileged local attacker can exploit the CWE-415 double-free condition to achieve arbitrary code execution at an elevated privilege level, effectively gaining full control over confidentiality, integrity, and availability of the affected system. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity, limiting immediate widespread risk; a vendor-released patch is available via Microsoft's Security Response Center.
Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
Kernel heap corruption and GPU memory leaks in Imagination Technologies Graphics DDK expose systems to local denial-of-service from non-privileged users. A double-free defect in the GPU memory free paths - triggered via user-initiated GPU system calls - can corrupt kernel heap state or cause memory leaks, with potential availability impact at the kernel level. No active exploitation is confirmed (EPSS 0.15%, no CISA KEV listing), but a vendor patch is available and a ChromeOS stable channel advisory confirms real-world distribution reach.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Windows Autopilot on Windows 11 versions 24H2, 25H2, and 26H1 contains a double-free memory corruption flaw that allows a locally authenticated, low-privileged attacker to escalate to full system privileges. The vulnerability carries a CVSS 3.1 score of 7.0 with high attack complexity (AC:H), meaning reliable exploitation requires specific conditions or timing to be met rather than being trivially reproducible. A vendor-released patch is available via the Microsoft Security Response Center, and no public exploit has been identified at time of analysis.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation via a double-free memory corruption flaw in the Windows Kerberos implementation affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A low-privileged local attacker can exploit the CWE-415 double-free condition to achieve arbitrary code execution at an elevated privilege level, effectively gaining full control over confidentiality, integrity, and availability of the affected system. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity, limiting immediate widespread risk; a vendor-released patch is available via Microsoft's Security Response Center.
Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.