Memory Corruption
Monthly
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability.". Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 72.9%.
The Adobe Type Manager Font Driver (ATMFD.DLL) in Windows contains a memory corruption vulnerability that allows local privilege escalation, exploited by the Duqu 2.0 malware in targeted attacks against diplomatic entities.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 34.1%.
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 76.5%.
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.2%.
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Word 2007 through 2013 and SharePoint components contain a memory corruption vulnerability in RTF processing that allows remote code execution, heavily exploited by multiple APT groups throughout 2015-2017.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Internet Explorer 6 through 11 contain a use-after-free vulnerability in CMarkup::IsConnectedToPrimaryMarkup that allows remote code execution, exploited as a zero-day in April 2014 with initial attribution to APT groups.
Microsoft Word 2003 through 2013 contain a memory corruption vulnerability in RTF file parsing that allows remote code execution, exploited as a zero-day in targeted attacks against government and military organizations.
Internet Explorer 9 and 10 contain a use-after-free vulnerability in CMarkup object handling exploitable via crafted JavaScript, used in 'Operation SnowMan' watering hole attacks targeting US military and defense in early 2014.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 74.7%.
Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Internet Explorer 8 through 10 contain a memory corruption vulnerability allowing remote code execution via crafted websites, used in targeted attacks against defense and aerospace organizations in 2013.
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Internet Explorer 6 through 8 contain a use-after-free vulnerability in CDwnBindInfo object handling that allows remote code execution through crafted websites, exploited as a zero-day in December 2012.
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 84.4%.
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
A stack-based buffer overflow in win32k.sys RtlQueryRegistryValues function allows local privilege escalation and UAC bypass on Windows XP through Windows 7 via crafted REG_BINARY registry values.
Remote code execution in Microsoft Office 2003-2010 and Office for Mac 2004-2011 allows attackers to execute arbitrary code via malicious RTF documents. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 93.79% (100th percentile), indicating extremely high real-world exploitation likelihood. Microsoft released patches via security bulletin MS10-087. The vulnerability affects a wide range of Office versions across Windows and macOS platforms, representing significant enterprise exposure despite the 2010 disclosure date.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
Microsoft Office Excel 2002 through 2007 and Office for Mac contain a memory corruption vulnerability triggered by a specially crafted spreadsheet with a malformed FEATHEADER record, allowing remote code execution.
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Out-of-bounds write in vgmstream (through r2117) lets an attacker corrupt heap memory when a crafted EA SCHl audio file is decoded, triggered inside vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c via a manipulated coefficient entry/entries count. The vulnerable code path is reached from any application embedding the library - media players and game-audio converters that use vgmstream - but exploitation requires the victim to open or load the malicious file (passive user interaction); there is no network service to hit and no public exploit identified at time of analysis. The vendor rates it CVSS 4.0 5.3, while this assessment maps it to CVSS 3.1 AV:L/AC:L/PR:N/UI:R with Low confidentiality, integrity and availability impact and no demonstrated path to code execution.
Denial of service in GPAC 26.08-DEV can result from a use-after-free when a local user opens a crafted BIFS/MPEG-4 scene file containing malicious proto-library links. Exploitation requires local processing of an attacker-supplied file and the realistic outcome is an application crash with availability impact only; there is no demonstrated confidentiality or integrity impact and no demonstrated code execution. Publicly available exploit code exists, but the issue is low severity (CVSS 1.9 in the supplied 4.0 vector) and the independent assessment notes the PR:L requirement is questionable, viewing the attack as local file parsing with user interaction. The vulnerability is fixed in GPAC abi-16.24 via commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.
Local use-after-free in GPAC's scenegraph command handling (gf_sg_command_apply / gf_node_deactivate_ex) lets an attacker crash MP4Box and other GPAC-based tools when a victim opens or converts a crafted LASeR/SVG scene, or an MP4 that embeds one. The vector is local and requires the victim to process the malicious media, and the assessed impact is availability only (process crash; C:N/I:N/A:L) with no confidentiality or integrity loss and no demonstrated code execution. Publicly available exploit code exists (a PoC archive was published alongside the VulDB report), the issue is fixed by the GPAC abi-16.24 release, and it is explicitly distinct from CVE-2026-90827.
Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's own CVSS 4.0 base of 4.6 aligns with the independent assessment that the reliably demonstrated impact is a crash rather than proven code execution.
Denial of service in ISC BIND 9 recursive resolvers: an attacker who controls (or compromises) an authoritative server for a DNSSEC-signed zone can cause `named` to abort after it encounters a use-after-free when processing a specific crafted sequence of answers. The attacker must first induce the victim resolver to issue multiple queries for that attacker-hosted zone, and the malicious responses must then arrive in a particular order and timing to trip the race, which is why this is rated high complexity (AC:H) despite being remote and unauthenticated (PR:N, no user interaction). Impact is availability-only (C:N/I:N/A:H), and exploitation is limited to `named` running as a recursive resolver on the listed versions; only 9.20.29 and later are fixed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
Use-after-free in FreeRDP's smartcard RDPDR device handler (before 3.31.0) allows a malicious or compromised RDP server to free a registered device pointer while the device manager still holds a reference, producing a dangling pointer that can crash the client or potentially be leveraged for code execution in the victim's session. The flaw is only reachable when a client with smartcard redirection enabled connects to an attacker-controlled RDP endpoint and the attacker can force a worker-thread creation failure during channel setup — a narrow, non-deterministic window reflected in the low CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P, availability-only impact). A vendor patch is available in FreeRDP 3.31.0; no public exploit code and no CISA KEV listing were identified at time of analysis.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
A type confusion flaw (CWE-843) in multiple Apple operating systems lets an already-installed, locally executing app trigger a type-handling error that ends in unexpected system termination, giving a crash-based denial of service but no path to code execution, privilege gain, or data access. Affected are iOS/iPadOS before 26.7 (and the 27 line before 27), macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and tvOS, visionOS and watchOS before 27; Apple has shipped fixed versions in each of those releases, and exploitation requires an authenticated local app context (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and EPSS is only 0.17% (7th percentile), so despite the MEDIUM 5.5 rating this is a genuinely low-priority issue with limited impact beyond a system crash.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
A use-after-free in GPAC's scene-graph handling (gf_sg_script_load path) lets a crafted MP4/VRML scene file corrupt memory when processed by MP4Box or any application embedding libgpac. Publicly available exploit code exists and the flaw is remotely deliverable, though exploitation requires the victim or an ingestion pipeline to actually open the malicious media file (UI:P). A vendor fix is available in release abi-16.23 / commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24, and the CVSS 4.0 base score is only 2.1 because confidentiality, integrity and availability impacts are all rated Low.
Use-after-free
Use-after-free in GPAC's `gf_node_unregister` function (scenegraph/base_scenegraph.c) allows an attacker to cause a crash or limited memory corruption by supplying a crafted MP4, BT, or XMT scene file. The vulnerability arises from improper cleanup ordering of proto field default node values during scene graph teardown, with additional related issues in the BT and XMT scene loaders. A public proof-of-concept exploit exists (GitHub issue #3801 and dedicated write-up), though the CVSS 4.0 score of 2.1 and all-Low impact metrics indicate reliable code execution is unlikely - DoS via crash is the primary realistic outcome. No CISA KEV listing exists.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability.". Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 72.9%.
The Adobe Type Manager Font Driver (ATMFD.DLL) in Windows contains a memory corruption vulnerability that allows local privilege escalation, exploited by the Duqu 2.0 malware in targeted attacks against diplomatic entities.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 34.1%.
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 76.5%.
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.2%.
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Word 2007 through 2013 and SharePoint components contain a memory corruption vulnerability in RTF processing that allows remote code execution, heavily exploited by multiple APT groups throughout 2015-2017.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Internet Explorer 6 through 11 contain a use-after-free vulnerability in CMarkup::IsConnectedToPrimaryMarkup that allows remote code execution, exploited as a zero-day in April 2014 with initial attribution to APT groups.
Microsoft Word 2003 through 2013 contain a memory corruption vulnerability in RTF file parsing that allows remote code execution, exploited as a zero-day in targeted attacks against government and military organizations.
Internet Explorer 9 and 10 contain a use-after-free vulnerability in CMarkup object handling exploitable via crafted JavaScript, used in 'Operation SnowMan' watering hole attacks targeting US military and defense in early 2014.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 74.7%.
Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Internet Explorer 8 through 10 contain a memory corruption vulnerability allowing remote code execution via crafted websites, used in targeted attacks against defense and aerospace organizations in 2013.
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Internet Explorer 6 through 8 contain a use-after-free vulnerability in CDwnBindInfo object handling that allows remote code execution through crafted websites, exploited as a zero-day in December 2012.
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 84.4%.
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
A stack-based buffer overflow in win32k.sys RtlQueryRegistryValues function allows local privilege escalation and UAC bypass on Windows XP through Windows 7 via crafted REG_BINARY registry values.
Remote code execution in Microsoft Office 2003-2010 and Office for Mac 2004-2011 allows attackers to execute arbitrary code via malicious RTF documents. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 93.79% (100th percentile), indicating extremely high real-world exploitation likelihood. Microsoft released patches via security bulletin MS10-087. The vulnerability affects a wide range of Office versions across Windows and macOS platforms, representing significant enterprise exposure despite the 2010 disclosure date.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
Microsoft Office Excel 2002 through 2007 and Office for Mac contain a memory corruption vulnerability triggered by a specially crafted spreadsheet with a malformed FEATHEADER record, allowing remote code execution.
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Out-of-bounds write in vgmstream (through r2117) lets an attacker corrupt heap memory when a crafted EA SCHl audio file is decoded, triggered inside vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c via a manipulated coefficient entry/entries count. The vulnerable code path is reached from any application embedding the library - media players and game-audio converters that use vgmstream - but exploitation requires the victim to open or load the malicious file (passive user interaction); there is no network service to hit and no public exploit identified at time of analysis. The vendor rates it CVSS 4.0 5.3, while this assessment maps it to CVSS 3.1 AV:L/AC:L/PR:N/UI:R with Low confidentiality, integrity and availability impact and no demonstrated path to code execution.
Denial of service in GPAC 26.08-DEV can result from a use-after-free when a local user opens a crafted BIFS/MPEG-4 scene file containing malicious proto-library links. Exploitation requires local processing of an attacker-supplied file and the realistic outcome is an application crash with availability impact only; there is no demonstrated confidentiality or integrity impact and no demonstrated code execution. Publicly available exploit code exists, but the issue is low severity (CVSS 1.9 in the supplied 4.0 vector) and the independent assessment notes the PR:L requirement is questionable, viewing the attack as local file parsing with user interaction. The vulnerability is fixed in GPAC abi-16.24 via commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.
Local use-after-free in GPAC's scenegraph command handling (gf_sg_command_apply / gf_node_deactivate_ex) lets an attacker crash MP4Box and other GPAC-based tools when a victim opens or converts a crafted LASeR/SVG scene, or an MP4 that embeds one. The vector is local and requires the victim to process the malicious media, and the assessed impact is availability only (process crash; C:N/I:N/A:L) with no confidentiality or integrity loss and no demonstrated code execution. Publicly available exploit code exists (a PoC archive was published alongside the VulDB report), the issue is fixed by the GPAC abi-16.24 release, and it is explicitly distinct from CVE-2026-90827.
Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's own CVSS 4.0 base of 4.6 aligns with the independent assessment that the reliably demonstrated impact is a crash rather than proven code execution.
Denial of service in ISC BIND 9 recursive resolvers: an attacker who controls (or compromises) an authoritative server for a DNSSEC-signed zone can cause `named` to abort after it encounters a use-after-free when processing a specific crafted sequence of answers. The attacker must first induce the victim resolver to issue multiple queries for that attacker-hosted zone, and the malicious responses must then arrive in a particular order and timing to trip the race, which is why this is rated high complexity (AC:H) despite being remote and unauthenticated (PR:N, no user interaction). Impact is availability-only (C:N/I:N/A:H), and exploitation is limited to `named` running as a recursive resolver on the listed versions; only 9.20.29 and later are fixed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
Use-after-free in FreeRDP's smartcard RDPDR device handler (before 3.31.0) allows a malicious or compromised RDP server to free a registered device pointer while the device manager still holds a reference, producing a dangling pointer that can crash the client or potentially be leveraged for code execution in the victim's session. The flaw is only reachable when a client with smartcard redirection enabled connects to an attacker-controlled RDP endpoint and the attacker can force a worker-thread creation failure during channel setup — a narrow, non-deterministic window reflected in the low CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P, availability-only impact). A vendor patch is available in FreeRDP 3.31.0; no public exploit code and no CISA KEV listing were identified at time of analysis.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
A type confusion flaw (CWE-843) in multiple Apple operating systems lets an already-installed, locally executing app trigger a type-handling error that ends in unexpected system termination, giving a crash-based denial of service but no path to code execution, privilege gain, or data access. Affected are iOS/iPadOS before 26.7 (and the 27 line before 27), macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and tvOS, visionOS and watchOS before 27; Apple has shipped fixed versions in each of those releases, and exploitation requires an authenticated local app context (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and EPSS is only 0.17% (7th percentile), so despite the MEDIUM 5.5 rating this is a genuinely low-priority issue with limited impact beyond a system crash.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
A use-after-free in GPAC's scene-graph handling (gf_sg_script_load path) lets a crafted MP4/VRML scene file corrupt memory when processed by MP4Box or any application embedding libgpac. Publicly available exploit code exists and the flaw is remotely deliverable, though exploitation requires the victim or an ingestion pipeline to actually open the malicious media file (UI:P). A vendor fix is available in release abi-16.23 / commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24, and the CVSS 4.0 base score is only 2.1 because confidentiality, integrity and availability impacts are all rated Low.
Use-after-free
Use-after-free in GPAC's `gf_node_unregister` function (scenegraph/base_scenegraph.c) allows an attacker to cause a crash or limited memory corruption by supplying a crafted MP4, BT, or XMT scene file. The vulnerability arises from improper cleanup ordering of proto field default node values during scene graph teardown, with additional related issues in the BT and XMT scene loaders. A public proof-of-concept exploit exists (GitHub issue #3801 and dedicated write-up), though the CVSS 4.0 score of 2.1 and all-Low impact metrics indicate reliable code execution is unlikely - DoS via crash is the primary realistic outcome. No CISA KEV listing exists.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.