Monthly
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.
Denial of service in FreeRDP 3.32.0: a use-after-free in the drdynvc dynamic virtual channel allows a malicious RDP server to crash the client during teardown by sending one crafted Virtual Channel PDU with a totalLength smaller than the chunk size. The victim must initiate an RDP session to the attacker-controlled or compromised server (UI:P), so passive clients are not exposed; the assessed impact is availability-only with no confidentiality or integrity loss. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV.
Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.
Denial of service in FreeRDP 3.32.0: a use-after-free in the drdynvc dynamic virtual channel allows a malicious RDP server to crash the client during teardown by sending one crafted Virtual Channel PDU with a totalLength smaller than the chunk size. The victim must initiate an RDP session to the attacker-controlled or compromised server (UI:P), so passive clients are not exposed; the assessed impact is availability-only with no confidentiality or integrity loss. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV.
Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.