Memory Corruption

Heap memory corruption in snappy-java 1.1.10.8 and earlier allows remote attackers to write attacker-influenced bytes past the bounds of the output array when an application decompresses untrusted compressed data through the typed Snappy.uncompress*Array APIs (such as uncompressIntArray, uncompressFloatArray, or uncompressDoubleArray), which size their result array using the uncompressed length divided by element size while forwarding the undivided length to the native JNI layer. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L) no authentication or user interaction is needed, but exploitation is conditional: the consuming application must expose the typed decompression path to attacker-controlled input, and applications that only use the generic byte[] uncompress path are not exposed. Impact is currently rated Low integrity and Low availability (heap corruption and crash) with no confirmed confidentiality loss or demonstrated code execution, and no public exploit was identified at time of analysis; this is a genuine memory-corruption flaw but a moderate, not top-tier, priority, and no vendor-released fixed version is identified in the available data.

Out-of-bounds write in vgmstream (through r2117) lets an attacker corrupt heap memory when a crafted EA SCHl audio file is decoded, triggered inside vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c via a manipulated coefficient entry/entries count. The vulnerable code path is reached from any application embedding the library - media players and game-audio converters that use vgmstream - but exploitation requires the victim to open or load the malicious file (passive user interaction); there is no network service to hit and no public exploit identified at time of analysis. The vendor rates it CVSS 4.0 5.3, while this assessment maps it to CVSS 3.1 AV:L/AC:L/PR:N/UI:R with Low confidentiality, integrity and availability impact and no demonstrated path to code execution.

Heap buffer overflow in an unspecified Ubuntu utility's duplicate_legacy_root_dir function can lead to high confidentiality, integrity, and availability impact when a local attacker convinces a user or automated job to process a crafted input, such as a malicious filesystem image or legacy-format file. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local access, no privileges required, and user interaction as the primary limiting factor, but the exact product, affected versions, and trigger condition are unconfirmed due to the record lacking product name, CWE, EPSS, KEV, and POC data. No public exploit identified at time of analysis.

Heap buffer overflow in the FAT-filesystem parsing code paths identified as _init_fats and fat_table_read - most likely the libparted FAT module used by GNU Parted and its fatresize component - allows memory corruption when a malformed FAT volume is parsed. The issue is local in scope (AV:L) and requires user interaction (UI:R): a victim must open a crafted disk/partition image or insert a removable device whose FAT table has been manipulated, and a parsing path (resize, inspection, or a mount helper such as udisks auto-mount handling) must actually read that volume. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates unauthenticated local attackers can achieve high confidentiality, integrity, and availability impact if the bug is reliably triggered, though whether the overflow yields code execution rather than a crash is unproven and impact is amplified only if the parser runs with elevated privileges. No CISA KEV entry and no public exploit code have been identified - no public exploit identified at time of analysis - and no EPSS score was supplied; the exact affected package, version range, and default-configuration reachability remain unconfirmed from the available data.

Denial of service in GPAC 26.08-DEV can result from a use-after-free when a local user opens a crafted BIFS/MPEG-4 scene file containing malicious proto-library links. Exploitation requires local processing of an attacker-supplied file and the realistic outcome is an application crash with availability impact only; there is no demonstrated confidentiality or integrity impact and no demonstrated code execution. Publicly available exploit code exists, but the issue is low severity (CVSS 1.9 in the supplied 4.0 vector) and the independent assessment notes the PR:L requirement is questionable, viewing the attack as local file parsing with user interaction. The vulnerability is fixed in GPAC abi-16.24 via commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.

Local use-after-free in GPAC's scenegraph command handling (gf_sg_command_apply / gf_node_deactivate_ex) lets an attacker crash MP4Box and other GPAC-based tools when a victim opens or converts a crafted LASeR/SVG scene, or an MP4 that embeds one. The vector is local and requires the victim to process the malicious media, and the assessed impact is availability only (process crash; C:N/I:N/A:L) with no confidentiality or integrity loss and no demonstrated code execution. Publicly available exploit code exists (a PoC archive was published alongside the VulDB report), the issue is fixed by the GPAC abi-16.24 release, and it is explicitly distinct from CVE-2026-90827.

Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's own CVSS 4.0 base of 4.6 aligns with the independent assessment that the reliably demonstrated impact is a crash rather than proven code execution.

Denial of service in ISC BIND 9 recursive resolvers: an attacker who controls (or compromises) an authoritative server for a DNSSEC-signed zone can cause `named` to abort after it encounters a use-after-free when processing a specific crafted sequence of answers. The attacker must first induce the victim resolver to issue multiple queries for that attacker-hosted zone, and the malicious responses must then arrive in a particular order and timing to trip the race, which is why this is rated high complexity (AC:H) despite being remote and unauthenticated (PR:N, no user interaction). Impact is availability-only (C:N/I:N/A:H), and exploitation is limited to `named` running as a recursive resolver on the listed versions; only 9.20.29 and later are fixed, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.

Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.

Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.

An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.

A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.

An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.

A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.

Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.

An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.

Use-after-free in FreeRDP's smartcard RDPDR device handler (before 3.31.0) allows a malicious or compromised RDP server to free a registered device pointer while the device manager still holds a reference, producing a dangling pointer that can crash the client or potentially be leveraged for code execution in the victim's session. The flaw is only reachable when a client with smartcard redirection enabled connects to an attacker-controlled RDP endpoint and the attacker can force a worker-thread creation failure during channel setup — a narrow, non-deterministic window reflected in the low CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P, availability-only impact). A vendor patch is available in FreeRDP 3.31.0; no public exploit code and no CISA KEV listing were identified at time of analysis.

Use-after-free in Mozilla Firefox's Audio/Video: Web Codecs component allows a remote attacker to crash the browser's content process by getting a victim to load crafted media that is decoded or encoded through the WebCodecs API. The issue affects Firefox builds prior to 156 and the ESR branches prior to 140.16 (ESR 140) and 153.3 (ESR 153), and has been fixed by Mozilla in those releases. Impact is confined to availability - the memory-safety bug is not assessed as enabling code execution or data theft - and every quantitative signal points to low real-world priority: EPSS is just 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis. Note that NVD publishes this as AV:N/AC:L/PR:N/UI:N, while our assessment reclassifies it as UI:R because exploitation realistically requires the victim to render attacker-controlled media.

Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.

Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.

Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.

Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.

An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.

A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.

An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.

Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.

A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.

An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).

An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.

Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.

An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.

An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.

A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.

An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.

Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.

An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.

An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.

Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.

A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.

An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.

An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.

A type confusion flaw (CWE-843) in multiple Apple operating systems lets an already-installed, locally executing app trigger a type-handling error that ends in unexpected system termination, giving a crash-based denial of service but no path to code execution, privilege gain, or data access. Affected are iOS/iPadOS before 26.7 (and the 27 line before 27), macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and tvOS, visionOS and watchOS before 27; Apple has shipped fixed versions in each of those releases, and exploitation requires an authenticated local app context (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and EPSS is only 0.17% (7th percentile), so despite the MEDIUM 5.5 rating this is a genuinely low-priority issue with limited impact beyond a system crash.

A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.

Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.

A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).

A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.

A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.

A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.

A use-after-free in GPAC's scene-graph handling (gf_sg_script_load path) lets a crafted MP4/VRML scene file corrupt memory when processed by MP4Box or any application embedding libgpac. Publicly available exploit code exists and the flaw is remotely deliverable, though exploitation requires the victim or an ingestion pipeline to actually open the malicious media file (UI:P). A vendor fix is available in release abi-16.23 / commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24, and the CVSS 4.0 base score is only 2.1 because confidentiality, integrity and availability impacts are all rated Low.

Use-after-free

Use-after-free in GPAC's `gf_node_unregister` function (scenegraph/base_scenegraph.c) allows an attacker to cause a crash or limited memory corruption by supplying a crafted MP4, BT, or XMT scene file. The vulnerability arises from improper cleanup ordering of proto field default node values during scene graph teardown, with additional related issues in the BT and XMT scene loaders. A public proof-of-concept exploit exists (GitHub issue #3801 and dedicated write-up), though the CVSS 4.0 score of 2.1 and all-Low impact metrics indicate reliable code execution is unlikely - DoS via crash is the primary realistic outcome. No CISA KEV listing exists.

Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.

Out-of-bounds write in CONPROSYS nano Series Remote I/O Coupler Units from Contec Co., Ltd. enables remote attackers with low-privilege network access to crash affected industrial automation devices by sending specially crafted network requests. Affected hardware includes server-type couplers (CPSN-MCB271), EtherNet/IP adapter variants (CPSN-EOB471EI), and software PLC-type units (CPSN-PCB271-S1-041), placing operational technology environments at risk of physical process disruption from device-level DoS. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.

Use-after-free in GPAC's scene graph management allows remote attackers to cause memory corruption via a crafted multimedia scene file. The flaw exists in `gf_node_changed_internal` within `base_scenegraph.c` and is triggered when GPAC's BT/XMT scene loaders fail to properly track node lifecycle, leaving dangling references to freed nodes in `def_nodes` lists and proto field structures. A public proof-of-concept exploit has been disclosed and the vendor has released a fix in tag abi-16.23. No confirmed active exploitation (KEV) is recorded at time of analysis.

Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.

Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.

Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.

Out-of-bounds write in the camera GDC (Geometric Distortion Correction) hardware driver on Samsung Exynos 1330, 1380, 1480, and 2400 SoCs can corrupt kernel memory under specific operating conditions. The vulnerability is reachable by low-privileged processes with camera subsystem access and crosses a privilege boundary into the kernel, despite the low CVSS availability-only impact scoring. No public exploit has been identified at time of analysis, and Samsung has published a dedicated advisory.

Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.

Use-After-Free in the Samsung Exynos DRM HDR kernel driver causes a kernel crash on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 SoCs. The defect lies in the error-handling path of the HDR driver: when a vmap() call fails, cleanup does not properly invalidate the freed mapping, leaving a dangling reference that is subsequently dereferenced, crashing the kernel. The CVSS vector (AV:L/AC:H/PR:L) indicates a local low-privileged attacker can trigger this under specific error conditions, crossing into kernel scope (S:C). No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.

Use-after-free in GPAC's MP4Box multimedia tool (all versions through commit f1219cde) allows a local low-privileged attacker to corrupt heap memory via the gf_list_count function in utils/list.c, resulting in application crashes and potentially limited code execution within the process. The fix released in abi-16.23 (commit 49dee5cad329) addresses multiple interrelated UAF and null-dereference conditions across the scenegraph manager, BIFS memory decoder, and AV1 reframer subsystems. A public proof-of-concept exploit exists; no active exploitation has been confirmed via CISA KEV.

Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.

Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.

Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.

Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.

Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.7.19 when the patch argument is a subtree of the target object. The function deletes the target before duplicating the patch, freeing the patch memory and causing a subsequent read of freed heap - confirmed by an AddressSanitizer-triggering test case in upstream fix PR #1065. A public exploit exists (GitHub issue #1060) and can lead to crash, potential memory disclosure, or memory corruption in any application that passes attacker-influenced JSON through this specific merge-patch call pattern.

A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. No public exploit code and no CISA KEV entry were identified at time of analysis, EPSS places exploitation probability at roughly 0.15% (5th percentile), and the supplied references do not state an exact fixed build number.

Out-of-bounds write in libsthmbc.so affects Samsung Mobile devices running One UI prior to version 8.5, allowing local low-privilege attackers to corrupt memory beyond allocated buffer boundaries. The CVSS 4.0 vector assigns high confidentiality impact (VC:H), indicating the write primitive can be leveraged to read or expose sensitive adjacent memory content. No public exploit has been identified at time of analysis, and Samsung has shipped a fix in the One UI 8.5 security update.

Out-of-bounds write in libsavscmn.so, a shared library component of Samsung One UI, enables local attackers holding low-level user privileges to execute arbitrary code on affected devices. All Samsung devices running One UI prior to version 8.5 are in scope, with the fix delivered in the September 2026 One UI 8.5 security update as documented in Samsung Mobile's bulletin. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA's KEV catalog.

Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026.

Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.

Use-after-free in Chrome's V8 JavaScript engine enables an attacker with a pre-compromised renderer process to read arbitrary memory within the sandbox boundaries via a crafted HTML page. Affected versions are Chrome prior to 153.0.8010.36 on all desktop platforms. Unlike most Chrome UAF findings that achieve sandbox escape, this vulnerability is constrained to intra-sandbox memory disclosure (C:L, S:U), making it a stepping-stone primitive rather than a standalone critical exploit. No public exploit code or CISA KEV listing exists at time of analysis.

Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.

Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.

Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.

Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.

Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.

Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows a local non-privileged process to access already-freed GPU memory through otherwise-valid GPU memory processing operations. The flaw spans a wide range of driver releases across all three GPU families - covering most modern Arm Mali GPU generations deployed in Android SoCs from r41p0 onward. No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), and the vulnerability is not listed in the CISA KEV catalog.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows an unprivileged local process to access already freed kernel memory, leaking limited sensitive data. The flaw is triggered through valid GPU memory processing operations, requiring no special privileges beyond local code execution - a realistic threat on mobile devices running affected Mali GPU firmware. With EPSS at 0.14% and no public exploit or KEV listing, active exploitation is not currently observed, but the breadth of affected versions across three GPU families and many Android SoC generations elevates overall exposure.

Use-after-free memory access in Arm's Valhall and 5th Gen GPU Architecture userspace drivers allows a non-privileged local process - including browser-hosted WebGL or WebGPU workloads - to read and write already-freed GPU memory regions, yielding limited confidentiality and integrity compromise. Arm reported this issue internally; no active exploitation has been identified. The wide deployment of Arm Mali GPU hardware in mobile and embedded SoCs makes the affected driver versions relevant across a large device population, though the limited CVSS impact scores constrain severity.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU kernel drivers allows a local unprivileged process to access already-freed GPU memory through valid GPU memory processing operations, resulting in limited confidentiality and integrity impact against the kernel driver. The flaw spans a wide range of driver versions across all three GPU architectures, affecting the enormous ecosystem of Android and embedded devices powered by Arm Mali GPUs. No public exploit or active exploitation has been identified; SSVC rates technical impact as partial and exploitation as none at time of analysis.

Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.

Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.

Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.

Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.