Use After Free
Monthly
A use-after-free in Apple macOS kernel memory management allows a locally installed and executed app to escalate to kernel privileges and run arbitrary code with full system control. Affected releases are macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; Apple shipped fixes in all three branches. The flaw is a local privilege escalation (CVSS 7.8, AV:L/PR:L) rather than a remote code execution bug, and there is no public exploit code or CISA KEV listing identified at time of analysis, so real-world exploitation currently depends on an attacker first getting a malicious app onto the target Mac.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free in Google Chrome's DevTools component (versions prior to 153.0.8010.36) enables arbitrary code execution within the renderer sandbox when a victim is socially engineered into visiting a crafted HTML page. The CVSS score of 8.8 reflects full C/I/A impact, but Chromium's own internal severity classification of 'Low' signals that exploitation is sandboxed - OS-level compromise requires an additional chained sandbox escape. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Use-after-free in Chrome's V8 JavaScript engine allows a remote attacker who can socially engineer a victim into installing a crafted Chrome extension to execute arbitrary code within the browser's renderer sandbox, affecting all Chrome versions prior to 153.0.8010.36. The vulnerability is constrained to in-sandbox execution - it does not constitute a standalone sandbox escape - which aligns with the S:U CVSS metric and Chromium's internal 'Medium' severity rating despite the 8.8 base score. No public exploit code or active exploitation has been identified at time of analysis, and Google has shipped a patch in the stable channel.
Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.
Use-after-free in Chrome's Chromecast component allows remote attackers to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Affected are all Google Chrome releases prior to 153.0.8010.36 across desktop platforms. Exploitation is sandboxed - code execution is confined to the renderer process - but the C:H/I:H/A:H impact rating reflects full compromise of data accessible within that context. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution inside the Chrome sandbox is possible in Google Chrome versions prior to 153.0.8010.36 via a use-after-free vulnerability in the V8 JavaScript engine, triggered by a specially crafted HTML page. An unauthenticated remote attacker who can lure a user to a malicious page can execute arbitrary code within the Chrome renderer process sandbox - a significant foothold even without a sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% reflects low observed exploitation activity, though V8 UAF primitives are historically attractive to threat actors.
Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Use-after-free in V8, Chrome's JavaScript engine, enables remote code execution within the browser's renderer sandbox when a victim visits a crafted HTML page. All Chrome releases prior to 153.0.8010.36 are affected across desktop platforms. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), but SSVC rates the technical impact as total, and the Chromium security team classified this as High severity.
Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.
Use-after-free in Chrome's Input component enables in-sandbox remote code execution against all Chrome versions prior to 153.0.8010.36. The vulnerability is triggered when a victim visits a crafted HTML page, requiring no authentication and no special configuration - only a single browse action. Google has rated this High severity, the patch is available in 153.0.8010.36, and no public exploit has been identified at time of analysis, with EPSS at 0.21%.
Use-after-free in Chrome's Platform component (all versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a crafted HTML page. The Chromium team rated this 'High' severity - consistent with the CVSS 8.8 score and distinguishing it from Critical-rated full sandbox-escape vulnerabilities addressed in the same release cycle. No public exploit code has been identified, and the EPSS score of 0.21% (12th percentile) reflects limited observed exploitation activity at this time; no CISA KEV listing exists.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.
Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.
Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.
Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Use-after-free in Microsoft Word enables remote code execution when a victim opens or interacts with a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects delivery over the network with no authentication required and only a single user interaction - opening a malicious file - as the prerequisite. Full confidentiality, integrity, and availability compromise is achievable on the affected endpoint, spanning Microsoft Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Remote code execution in Microsoft Office Word via a use-after-free (CWE-416) memory corruption flaw allows an unauthenticated network attacker to compromise a target system when the victim opens a specially crafted document. All major release tracks are affected - Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS - with fixed builds published by Microsoft. No CISA KEV listing or public exploit has been identified at time of analysis, but the CVSS 8.8 PR:N/UI:R profile is characteristic of document-delivery RCE bugs historically prioritized by both criminal and nation-state actors for initial access.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Remote code execution via a use-after-free defect in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated network attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability resides in a kernel-mode multicast transport driver, and successful exploitation achieves full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
A use-after-free in Apple macOS kernel memory management allows a locally installed and executed app to escalate to kernel privileges and run arbitrary code with full system control. Affected releases are macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; Apple shipped fixes in all three branches. The flaw is a local privilege escalation (CVSS 7.8, AV:L/PR:L) rather than a remote code execution bug, and there is no public exploit code or CISA KEV listing identified at time of analysis, so real-world exploitation currently depends on an attacker first getting a malicious app onto the target Mac.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free in Google Chrome's DevTools component (versions prior to 153.0.8010.36) enables arbitrary code execution within the renderer sandbox when a victim is socially engineered into visiting a crafted HTML page. The CVSS score of 8.8 reflects full C/I/A impact, but Chromium's own internal severity classification of 'Low' signals that exploitation is sandboxed - OS-level compromise requires an additional chained sandbox escape. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Use-after-free in Chrome's V8 JavaScript engine allows a remote attacker who can socially engineer a victim into installing a crafted Chrome extension to execute arbitrary code within the browser's renderer sandbox, affecting all Chrome versions prior to 153.0.8010.36. The vulnerability is constrained to in-sandbox execution - it does not constitute a standalone sandbox escape - which aligns with the S:U CVSS metric and Chromium's internal 'Medium' severity rating despite the 8.8 base score. No public exploit code or active exploitation has been identified at time of analysis, and Google has shipped a patch in the stable channel.
Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.
Use-after-free in Chrome's Chromecast component allows remote attackers to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Affected are all Google Chrome releases prior to 153.0.8010.36 across desktop platforms. Exploitation is sandboxed - code execution is confined to the renderer process - but the C:H/I:H/A:H impact rating reflects full compromise of data accessible within that context. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution inside the Chrome sandbox is possible in Google Chrome versions prior to 153.0.8010.36 via a use-after-free vulnerability in the V8 JavaScript engine, triggered by a specially crafted HTML page. An unauthenticated remote attacker who can lure a user to a malicious page can execute arbitrary code within the Chrome renderer process sandbox - a significant foothold even without a sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% reflects low observed exploitation activity, though V8 UAF primitives are historically attractive to threat actors.
Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Use-after-free in V8, Chrome's JavaScript engine, enables remote code execution within the browser's renderer sandbox when a victim visits a crafted HTML page. All Chrome releases prior to 153.0.8010.36 are affected across desktop platforms. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), but SSVC rates the technical impact as total, and the Chromium security team classified this as High severity.
Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.
Use-after-free in Chrome's Input component enables in-sandbox remote code execution against all Chrome versions prior to 153.0.8010.36. The vulnerability is triggered when a victim visits a crafted HTML page, requiring no authentication and no special configuration - only a single browse action. Google has rated this High severity, the patch is available in 153.0.8010.36, and no public exploit has been identified at time of analysis, with EPSS at 0.21%.
Use-after-free in Chrome's Platform component (all versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a crafted HTML page. The Chromium team rated this 'High' severity - consistent with the CVSS 8.8 score and distinguishing it from Critical-rated full sandbox-escape vulnerabilities addressed in the same release cycle. No public exploit code has been identified, and the EPSS score of 0.21% (12th percentile) reflects limited observed exploitation activity at this time; no CISA KEV listing exists.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.
Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.
Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.
Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Use-after-free in Microsoft Word enables remote code execution when a victim opens or interacts with a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects delivery over the network with no authentication required and only a single user interaction - opening a malicious file - as the prerequisite. Full confidentiality, integrity, and availability compromise is achievable on the affected endpoint, spanning Microsoft Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Remote code execution in Microsoft Office Word via a use-after-free (CWE-416) memory corruption flaw allows an unauthenticated network attacker to compromise a target system when the victim opens a specially crafted document. All major release tracks are affected - Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS - with fixed builds published by Microsoft. No CISA KEV listing or public exploit has been identified at time of analysis, but the CVSS 8.8 PR:N/UI:R profile is characteristic of document-delivery RCE bugs historically prioritized by both criminal and nation-state actors for initial access.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Remote code execution via a use-after-free defect in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated network attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability resides in a kernel-mode multicast transport driver, and successful exploitation achieves full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.