Use After Free

Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.

Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.

Use-after-free in libexpat before 2.8.4 allows an attacker who can supply crafted XML with a custom unknown-encoding declaration to corrupt parser memory when the encoding convert or release callback re-enters the parser without handler-depth tracking. Affected applications are those that register an UnknownEncodingHandler via XML_SetUnknownEncodingHandler - a non-default but legitimate usage pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.9 with AV:L/AC:H reflects the constrained exploitation prerequisites, though the library's wide deployment footprint elevates aggregate risk.

Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.

Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.

Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.

Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.

Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.

Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.

Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.

Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.

Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.

Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.

Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.

Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.

Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.

Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.

Unexpected process termination in Apple iOS/iPadOS and macOS Tahoe can be triggered remotely by luring a user to visit maliciously crafted web content, exploiting a use-after-free flaw in the web content rendering engine. The vulnerability affects iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with impact limited to availability - crashing the affected browser or WebKit-based process - and no confirmed confidentiality or integrity loss. No public exploit code or CISA KEV listing is identified at time of analysis, though the low-complexity, network-accessible attack surface warrants prompt patching given the broad Apple device install base.

Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.

Use-after-free memory corruption in Apple's WebKit web rendering engine crashes the browser process when handling maliciously crafted web content on iOS, iPadOS, and macOS Tahoe. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network-reachable exploitation limited to availability impact - a process crash - with no confidentiality or integrity compromise. Apple has released fixes across both the legacy iOS 18.x branch and the current iOS 26.x line, indicating broad exposure across the installed base. No active exploitation or public proof-of-concept has been identified at time of analysis.

Use-after-free in HarmonyOS 6.1.0's time and time zone module allows a local low-privileged attacker to crash the affected component, degrading availability. Exploitation is local and requires existing user-level access, limiting the realistic attacker pool to on-device processes or malicious apps. No public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.

Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.

IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.

Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.

Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.

Use-after-free in Google Chrome's Extensions subsystem prior to version 151.0.7922.137 enables an attacker to execute arbitrary code inside the Chrome sandbox by convincing a target to install a crafted malicious extension. The vulnerability class (CWE-416) indicates improper memory management in the extension handling code, where a freed memory reference is later dereferenced, corrupting heap state in a way an attacker can direct toward code execution. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires deliberate social engineering to achieve extension installation.

Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.

Use-after-free (CWE-416) in OpenSSH's ssh client component affects all releases before version 10.5, triggered when a specific pair of remote-forwarding operations occur concurrently, causing access to freed realloc'd memory. A malicious or compromised SSH server could exploit this race condition against a connecting client to achieve partial information disclosure or limited memory corruption. No public exploit has been identified and CISA SSVC rates exploitation as none with partial technical impact, consistent with the moderate CVSS score of 4.8.

MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.

Use-after-free in MongoDB Server's geospatial validation subsystem allows an authenticated user with write privileges to crash the database server through concurrent operations against a collection using a specific validator type. Affected branches are MongoDB 7.0 (prior to 7.0.40), 8.0 (prior to 8.0.29), and 8.3.x (prior to 8.3.8), per EUVD advisory EUVD-2026-56913. No public exploit code exists and SSVC assessment indicates no current exploitation activity; patched releases are available from MongoDB.

Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.

Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.

Use-After-Free in the AMD Ryzen Master Utility Driver exposes kernel memory to a locally authenticated, high-privileged attacker, with the primary confirmed impact being system availability loss. The vulnerability (CWE-416) resides within the driver component bundled with both the Ryzen Master application and its Monitoring SDK, affecting all versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.6 reflects the restricted local, high-privilege attack surface despite the kernel-level nature of the flaw.

Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.

Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.

Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.

Privilege escalation via use-after-free in Windows Autopilot on Windows 11 allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level or elevated access. The vulnerability stems from improper memory management in the Autopilot provisioning component, where a freed memory region can be referenced again under a race condition (AC:H). Affected builds span both Windows 11 24H2 and 25H2 prior to the 9168 patch revision; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 versions 24H2 and 25H2 arises from a use-after-free memory corruption flaw, enabling a local low-privileged attacker to achieve full SYSTEM-level access with complete confidentiality, integrity, and availability impact. High attack complexity (AC:H) constrains opportunistic exploitation, making this most relevant to insider threat and post-breach lateral movement scenarios rather than broad automated attacks. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.

Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.

Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.

Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.

Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.

Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.

Remote code execution in Microsoft Active Directory Certificate Services (AD CS) is achievable by low-privileged authenticated network attackers through a use-after-free (CWE-416) memory corruption flaw. All supported Windows Server versions from 2012 through 2025 are affected, along with Windows 10 versions 1607 and 1809. Microsoft has released patches via the MSRC update guide; no public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version coverage make this a high-priority remediation item.

Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.

Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.

Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.

Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.

Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.

Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.

Privilege escalation via use-after-free memory corruption in the Windows Telephony Service (TAPI) affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An authorized local attacker with low-privilege credentials can exploit a race condition to corrupt freed memory within the telephony service process, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed by CISA KEV, and no public exploit has been identified at time of analysis; Microsoft has released patched builds for all affected platforms.

Local privilege escalation in the Windows Telephony Service (TAPI) allows an already-authenticated, low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans a wide range of Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the availability of a vendor patch make patching urgent in environments where Telephony Service is active.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, requiring physical device access to exploit. An attacker with physical proximity can trigger kernel memory corruption under high-complexity conditions to gain full control of the affected system, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and CISA SSVC confirms exploitation status as none.

Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.

Privilege escalation via use-after-free in the Windows Telephony Service (TAPI) allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access across a broad range of Windows desktop and server releases. The vulnerability affects Windows 10, Windows 11 (all current feature releases), and Windows Server 2012 through 2025, representing near-universal coverage of supported and legacy Microsoft platforms. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft Update.

Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.

Privilege escalation in Windows Installer (msiexec) on Windows 11 and Windows Server 2025 allows a locally authenticated low-privileged user to gain SYSTEM-level privileges by exploiting a use-after-free memory corruption condition. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core deployments. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft.

Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.

Local code execution in the Windows DHCP Client exposes Windows 11 and Windows Server 2025 systems to privilege escalation by authorized local users via a use-after-free memory corruption condition. The flaw (CWE-416) requires high attack complexity - consistent with race-condition-dependent UAF exploitation - and an existing local foothold (PR:L, AV:L), limiting its practical reach compared to its full C:H/I:H/A:H impact triad. No public exploit has been identified at time of analysis, and Microsoft has released a vendor-confirmed patch.

Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to elevate to SYSTEM-level access by exploiting a use-after-free memory corruption condition in the kernel-mode driver. The flaw spans a wide swath of Microsoft's supported and legacy Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, making the patching surface unusually broad. No public exploit code or active exploitation has been confirmed at time of analysis; however, the combination of kernel-level impact, full C/I/A compromise upon success, and low privilege prerequisite makes this a meaningful post-compromise escalation risk.

Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.

Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.

Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.

Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.

Use-after-free in Vim's JSON channel parsing (versions 9.2.0511 through 9.2.0843) causes the socketserver process to crash when processing malformed JSON messages that straddle read-buffer boundaries. The stale pointer p in json_decode_item() is invalidated when channel_fill() frees the underlying buffer mid-parse; the error-reporting code then reads freed memory, producing a crash with no code-execution or data-exfiltration potential. No active exploitation is confirmed and no public exploit code has been identified; vendor-released patch v9.2.0844 resolves the flaw.

Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.

Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.