Use After Free

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.65 stems from a use-after-free in the Sessions component (CVE-2026-79129, CWE-416). A remote attacker who lures a victim into a specific UI interaction (social engineering) can corrupt freed memory to run arbitrary code outside the renderer sandbox. Google has shipped a fixed build; no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC lists exploitation status as none.

Use-after-free in the Audio component of Google Chrome on Android (versions prior to 152.0.7977.65) enables sandbox escape and arbitrary code execution outside the Chrome renderer sandbox. Exploitation requires an attacker to have already compromised the renderer process and then deliver a crafted HTML page to trigger the memory corruption. No public exploit code or CISA KEV listing exists at time of analysis; SSVC confirms no active exploitation observed and the attack is not automatable.

Sandbox-escaping remote code execution in Google Chrome (desktop) before 152.0.7977.65 stems from a use-after-free in the Views UI framework, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw carries a CVSS 9.6 with scope change, though Google rated the Chromium security severity only Medium; there is no public exploit identified at time of analysis and SSVC lists exploitation as none. A vendor patch is available in the 152.0.7977.65 Stable channel release.

Sandbox-escaping remote code execution in Google Chrome's FedCM (Federated Credential Management) component affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and execute arbitrary code outside the renderer sandbox, giving full control of the browser process. Google rates the Chromium severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS base score is Critical (9.6) because of the scope change.

Use-after-free in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the browser renderer sandbox on all Chrome versions prior to 152.0.7977.65. Exploitation requires only a single user interaction - visiting a crafted HTML page - with no authentication or special privileges needed (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Despite full C/I/A impact within the sandbox, EPSS probability is low at 0.46% (38th percentile), SSVC exploitation status is 'none', and no public exploit or CISA KEV listing exists at time of analysis; a vendor patch has been released at version 152.0.7977.65.

Remote code execution inside the Chrome sandbox is achievable via a use-after-free in the WebRTC component of Google Chrome prior to 152.0.7977.65, exploitable by an unauthenticated remote attacker through crafted network traffic. The flaw requires high attack complexity (AC:H), constraining opportunistic mass exploitation, and code execution is limited to within the Chrome renderer sandbox, reducing but not eliminating post-exploitation impact. No public exploit code and no active exploitation have been identified at time of analysis, consistent with SSVC Exploitation: none and an EPSS of 0.66%.

Sandbox-escaping remote code execution affects Google Chrome desktop versions prior to 152.0.7977.65, where a use-after-free flaw in the Extensions component lets a remote attacker who convinces a victim to install a crafted extension execute arbitrary code outside the renderer sandbox. Chromium rates the severity High and CVSS scores it 9.6 due to the scope change (sandbox escape) and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at only 0.28% (20th percentile).

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the browser sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated 9.6/Critical with a scope change, meaning exploitation impacts the host beyond the compromised renderer. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the EPSS score of 0.41% reflects only near-term probability, not the true severity of a sandbox-escaping RCE.

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free rated CVSS 9.6 with scope change, reflecting the sandbox escape. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.41%, but the sandbox-escaping RCE impact makes it a high-priority browser patch.

Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Sandbox-escaping remote code execution in Google Chrome (Aura component) affects all desktop builds prior to 152.0.7977.65, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape, though exploitation requires the victim to load attacker-controlled content. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.

Sandbox-escaping remote code execution in Google Chrome's WebGL component affects all desktop builds prior to 152.0.7977.65. A crafted HTML page can trigger a use-after-free (CWE-416) whose exploitation, per the description, yields code execution outside the browser renderer sandbox - a notably severe outcome that Chrome typically confines. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.33% (25th percentile), consistent with SSVC marking exploitation as 'none' despite total technical impact.

Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.

Use-after-free in Google Chrome's Accessibility component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code outside the browser's renderer sandbox through social engineering. Exploitation requires user interaction with a malicious webpage or crafted UI element, making phishing or malvertising the likely delivery mechanism. A vendor patch is available in stable channel version 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.23% (14th percentile), suggesting opportunistic exploitation is not currently observed.

Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets an unauthenticated attacker escape the renderer sandbox and run arbitrary code on the host when a victim opens a crafted web page. The bug is a use-after-free in the Views UI framework, rated High by Chromium and carrying a CVSS 9.6 due to a scope change (sandbox escape). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.33%, 25th percentile).

Use-after-free in the Mobile component of Google Chrome on iOS prior to 152.0.7977.65 enables remote code execution outside the browser sandbox via crafted network traffic, requiring no user interaction. The sandbox escape elevates the severity beyond a typical renderer bug, as successful exploitation grants attacker-controlled code execution in a context beyond Chrome's sandboxed process. No public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation has not yet been observed in the wild despite the high CVSS rating.

Sandbox-escaping remote code execution in Google Chrome (Views UI component) before 152.0.7977.65 allows a remote attacker to run arbitrary code on the host after luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 9.6 due to the scope change (sandbox escape), but requires user interaction (visiting an attacker-controlled page) and has no public exploit identified at time of analysis. EPSS is modest (0.46%, 38th percentile) and CISA SSVC reports no known exploitation.

Use-after-free in the Bluetooth component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox. Exploitation requires the attacker to socially engineer a victim into installing or triggering a crafted Chrome extension, after which the memory corruption in the Bluetooth subsystem is leveraged to escape Chrome's sandbox and achieve code execution at the OS level. No public exploit identified at time of analysis, and EPSS places this in the 20th percentile, suggesting limited active exploitation despite the high CVSS severity.

Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the browser or OS level via crafted network traffic. All Chrome versions prior to 152.0.7977.65 on Windows are affected. No public exploit code or CISA KEV listing exists; EPSS is low at 0.28% (20th percentile), but the scope-changing, full-CIA-impact sandbox escape warrants rapid deployment of the available patch.

Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. No public exploit code has been identified at time of analysis; EPSS places exploitation probability at 0.28% (20th percentile), though the network vector and no-auth-required CVSS signal warrant prompt patching.

Sandbox escape via use-after-free in Google Chrome's Chromecast component lets a remote attacker who has already compromised the renderer process execute arbitrary code in the higher-privileged browser process, breaking out of the site-isolation sandbox. It affects Chrome desktop before 152.0.7977.65 and is triggered by luring a victim to a crafted HTML page (UI:R). No public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile) and CISA SSVC records exploitation status 'none'.

Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.

Sandbox-escaping remote code execution in Google Chrome (desktop, versions before 152.0.7977.65) stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the host process rather than just the renderer. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis, and EPSS exploitation probability is currently low (0.33%, 25th percentile).

Remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Safe Browsing component that lets a remote attacker escape the renderer sandbox and run arbitrary code on the host. Exploitation requires luring a victim to a crafted HTML page (social engineering / user interaction), and Chromium rates the flaw Critical. There is no public exploit identified and the EPSS probability is low (0.57%), but a vendor patch is already available.

Sandbox-escaping remote code execution in Google Chrome for macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI framework, letting a remote attacker run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and EPSS is a low 0.41%. A vendor patch is available in the Stable channel update.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a use-after-free in Aura, Chromium's UI/windowing layer, and Google rates its Chromium security severity as Critical (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.46%, 38th percentile), but the sandbox-escape impact makes it a high-priority patch.

Sandbox escape via use-after-free in Chrome's Chromecast component allows remote code execution outside the browser sandbox on all platforms running Chrome prior to 152.0.7977.65. This is a chained exploit: an attacker must first compromise the renderer process, then leverage the Chromecast UAF to pivot into the browser process and escape Chrome's sandbox via a crafted HTML page. No public exploit code has been identified at time of analysis; Google has released a confirmed fix in version 152.0.7977.65.

Use-after-free in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code on the underlying system via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at a low 0.46%, but SSVC rates technical impact as total given the sandbox-escape outcome.

Sandbox-escaping remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the renderer host process. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, though the class of bug is historically high-value.

Sandbox-escaping remote code execution in Google Chrome for Android (versions before 152.0.7977.65) stems from a use-after-free in ANGLE, Chrome's graphics translation layer. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving control at the browser-process privilege level. Chromium rates the flaw Critical; no public exploit has been identified at time of analysis, and the EPSS probability is low (0.35%).

Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis.

Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.

Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.

Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.

Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.

Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.

Use-after-free in libexpat before 2.8.4 enables a local low-privileged attacker to corrupt parser memory and potentially achieve arbitrary code execution by supplying a crafted XML document with custom encoding callbacks. The flaw stems from the unknown encoding callback path (convert/release handlers) bypassing the reentrancy depth-tracking guards applied to all other libexpat callbacks, allowing an attacker-controlled callback to re-enter the parser and corrupt its state. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.10% (1st percentile), though this belongs to a confirmed series of related reentrancy fixes in libexpat (CVE-2026-50219, CVE-2026-56131, CVE-2026-56412) and Red Hat has already shipped a backported errata.

Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.

Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.

Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.

Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.

Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.

Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.

Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.

Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.

Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.

Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.

Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.

Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.

Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.

Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.

Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.

Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.

Use-after-free in Google Chrome's Extensions subsystem prior to version 151.0.7922.137 enables an attacker to execute arbitrary code inside the Chrome sandbox by convincing a target to install a crafted malicious extension. The vulnerability class (CWE-416) indicates improper memory management in the extension handling code, where a freed memory reference is later dereferenced, corrupting heap state in a way an attacker can direct toward code execution. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires deliberate social engineering to achieve extension installation.

Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.

MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.

Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.

Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.

Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.

Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.

Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.

Privilege escalation via use-after-free in Windows Autopilot on Windows 11 allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level or elevated access. The vulnerability stems from improper memory management in the Autopilot provisioning component, where a freed memory region can be referenced again under a race condition (AC:H). Affected builds span both Windows 11 24H2 and 25H2 prior to the 9168 patch revision; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 versions 24H2 and 25H2 arises from a use-after-free memory corruption flaw, enabling a local low-privileged attacker to achieve full SYSTEM-level access with complete confidentiality, integrity, and availability impact. High attack complexity (AC:H) constrains opportunistic exploitation, making this most relevant to insider threat and post-breach lateral movement scenarios rather than broad automated attacks. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.

Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.

Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.

Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.

Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.

Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.

Remote code execution in Microsoft Active Directory Certificate Services (AD CS) is achievable by low-privileged authenticated network attackers through a use-after-free (CWE-416) memory corruption flaw. All supported Windows Server versions from 2012 through 2025 are affected, along with Windows 10 versions 1607 and 1809. Microsoft has released patches via the MSRC update guide; no public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version coverage make this a high-priority remediation item.

Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.

Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.

Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.