EUVD-2026-88433
GHSA-mqcv-532f-gp47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish MoQ/WebTransport session
-
DeliveryOpen data stream with unknown track alias + FIN in same write
-
ExploitRead FIN invalidates stream read handle
-
ExecutiondataStreamReadLoop reuses stale handle (UAF)
-
ImpactSession crash / memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication and no user interaction required (PR:N/UI:N): a remote peer that can establish a Media-over-QUIC (MoQ) session over proxygen's WebTransport API with the moxygen endpoint. The specific trigger is opening a data stream that names an unknown/unresolved track alias while carrying the FIN flag in the same write, so the read handle is invalidated by the FIN before dataStreamReadLoop stops using it. What LIMITS exploitation: the target must be running moxygen in the vulnerable commit range (>= b24f8e65cb83 and < 004123dd24c3), and the attacker must be able to open a MoQ data stream to it (i.e., reachable, session-accepting endpoint); this is an experimental library, not a default-deployed service. |
| Impact | Signals are mostly consistent toward a real-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U) shows a remotely and unauthenticated-triggerable use-after-free (CWE-416) requiring no user interaction, which is why it scores 7.5 (HIGH). However, exploitation signals temper this: EPSS is very low at 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code was identified - exploitation status is 'no public exploit identified at time of analysis.' CISA SSVC reinforces this: Exploitation=none, Automatable=yes, Technical Impact=partial (not total), yielding a 'Track'-style rather than 'Act' disposition. One notable inconsistency: the vendor CVSS assigns C:H/I:N/A:N (confidentiality-only) and the tags include 'Information Disclosure,' yet the underlying defect is a stale/use-after-free of a WebTransport stream read handle, whose most plausible real-world outcome is a session/process crash (availability/DoS) rather than data disclosure - the confidentiality-only weighting should be verified against the vendor advisory. A patch is available (commit 004123dd24c3), which is the primary reason this remains a patch-and-monitor rather than an emergency item. |
| Exploit ScenarioDerived | A remote peer establishes a Media-over-QUIC (MoQ) session with a moxygen endpoint running an affected commit and opens a data stream that references an unknown track alias while carrying the FIN in the same write. Reading the FIN invalidates the proxygen WebTransport stream read handle, but MoQSession::dataStreamReadLoop continues to use it, triggering the use-after-free. No authentication or user interaction is required; no public proof-of-concept is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Use-after-free in Meta's experimental moxygen Media-over-QUIC (MoQ) library (MoQSession::dataStreamReadLoop) lets a remote, unauthenticated peer corrupt memory and crash an endpoint that accepts MoQ sessions over proxygen's WebTransport API. The flaw is triggered when a data stream names an unknown/unresolved track alias and carries the FIN flag in the same write, so the stream read handle is invalidated by the FIN before the read loop finishes using it; affected builds are those from b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9 up to (excluding) the fix commit 004123dd24c30dad6b649163575145f240dabc94. Exploitation requires only that the target runs a vulnerable commit and exposes an accepting MoQ endpoint; there is no public exploit identified at time of analysis (EPSS 0.14%, third percentile; CISA SSVC exploitation:none), and the vendor fix is available as upstream commit 004123dd24c30dad6b649163575145f240dabc94.
RemediationAI
Apply the upstream fix by updating moxygen to commit 004123dd24c30dad6b649163575145f240dabc94 or any later revision, which replaces the raw StreamReadHandle usage in dataStreamReadLoop and controlReadLoop with the ReadHandleRef RAII wrapper that correctly invalidates the handle on FIN/cancellation; the vendor advisory (https://www.facebook.com/security/advisories/cve-2026-84894) documents the issue and the fix is public at https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94 - note that upstream fix available (commit); released patched version not independently confirmed, so verify the exact commit of any fork, vendored copy, or container image rather than relying on a version tag. If patching is not immediately possible, restrict exposure: do not run an accepting moxygen/MoQ WebTransport endpoint on untrusted networks - block or rate-limit inbound QUIC/WebTransport traffic from untrusted peers at the firewall or load balancer, since any peer able to open a MoQ data stream can reach the trigger (trade-off: this defeats the purpose of a public media relay and can disrupt legitimate clients). Run moxygen under a supervisor that restarts on abnormal termination and inside a sandbox or memory-limited cgroup to contain the crash and reduce secondary effects (trade-off: mitigates availability loss and memory-corruption fallout but does not eliminate the underlying UAF and may mask repeat triggers). Because exploitation requires an accepted MoQ session, enabling any client authentication or peer-allowlisting that exists in your deployment will also shrink the attack surface. Monitor for repeated abnormal process exits following streams that reference unknown track aliases as a likely exploitation indicator.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
moxygen is Meta's implementation of Media over QUIC (MoQ), a publish/subscribe transport for low-latency media built on QUIC and exposed through proxygen's WebTransport API. In proxygen's WebTransport model, a stream read handle (StreamReadHandle) is a lifetime-bound object: receiving a FIN on a stream invalidates the handle, and any subsequent dereference (readStreamData, getID, stopSending, or the handle's cancel token) touches freed state. In the vulnerable code, MoQSession::dataStreamReadLoop captured a raw StreamReadHandle pointer, registered a cancellation callback to null it, and used a scope guard to issue STOP_SENDING on exit; when a peer opened a data stream that referenced an unknown track alias while delivering the FIN in the same write, the early-return path around the fetch state left the loop's stale pointer live after the FIN invalidated the handle, producing a use-after-free (CWE-416). The upstream fix (commit 004123dd24c30dad6b649163575145f240dabc94) restructures the code around a ReadHandleRef RAII wrapper that refcounts/owns the handle, seeds the FIN state so a handed-over FIN still reaches close handling, and takes the cancel code last so an invalidated handle is never reused. Note that the vendor's CVSS vector (7.5, C:H/I:N/A:N) frames the bug as an information-disclosure issue, whereas our independent assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - availability impact from memory corruption - which is the basis for the impact stated here.
Know when Moxygen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated UAF of a freed WebTransport handle most plausibly crashes the session (A:H); confidentiality impact is unproven, so I diverge from the vendor's C:H/I:N/A:N.
Primary rating from Vendor (Meta).
CVSS VectorVendor: Meta
Lifecycle Timeline
4DescriptionCVE.org
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
Executive ViewAI
A use-after-free defect in Meta's experimental moxygen Media-over-QUIC (MoQ) library allows a remote peer to corrupt memory and crash any endpoint that accepts MoQ sessions through proxygen's WebTransport API. Exposure is limited to teams that build and run affected commits rather than to broadly deployed products, but an outage on a live media delivery path can still interrupt streaming services for downstream users. Remediation is well understood and low-cost - the vendor has published a fix commit - so leadership's main concern is confirming which internal or customer-facing builds actually contain the vulnerable code.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB