Use After Free

Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.

Remote code execution in the Blink rendering engine of Google Chrome versions prior to 150.0.7871.186 allows an attacker to run arbitrary code inside Chrome's sandbox when a victim visits a crafted HTML page. The vulnerability has a high CVSS score (8.8) but a low EPSS exploitation probability (0.30%), and no active exploitation has been observed (CISA KEV not listed). A vendor patch is available.

Remote code execution inside a sandbox in Google Chrome prior to 150.0.7871.186 allows attackers to execute arbitrary code via a crafted HTML page. This use-after-free vulnerability requires user interaction and has a high CVSS score but low real-world exploitation probability (EPSS 0.30%). No active exploitation or public exploit code has been identified.

Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.

Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.

Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.

Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.

Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.

Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.

Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.

Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.

Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.

Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.

Remote code execution and information disclosure in Google Chrome desktop before 150.0.7871.128 stems from a use-after-free flaw (CWE-416) that a malicious web page can trigger when a victim simply visits it. The CVSS 3.1 score of 9.6 with a scope change reflects a likely sandbox-boundary crossing, giving an attacker high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.22%, 12th percentile), but browser use-after-free bugs are a historically favored exploitation target.

Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).

Use-after-free memory corruption in Google Chrome versions prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially disclose sensitive information or execute code after a user visits a malicious web page. The flaw was reported through the Ubuntu vendor channel and fixed in Chrome's Stable desktop channel; no public exploit identified at time of analysis, and its EPSS exploitation probability is low (0.22%). Successful exploitation requires user interaction (visiting attacker-controlled content) but no authentication.

Use-after-free memory corruption in Google Chrome prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw carries a CVSS 9.6 with a scope change, reflecting the risk of escaping the renderer sandbox, though exploitation requires user interaction. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%, 19th percentile), consistent with a freshly patched browser bug that has not yet been weaponized.

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially achieve code execution or information disclosure after a victim visits an attacker-controlled page. The flaw carries a CVSS 9.6 with a scope change reflecting the browser sandbox boundary, but currently shows no public exploit and a low EPSS probability (0.22%, 12th percentile). It is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.

Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Use-after-free in the Linux kernel's ksmbd (in-kernel SMB3 server) durable-handle scavenger allows a remote client interacting with SMB2 durable handles to corrupt kernel memory and free a file object still referenced by concurrent m_fp_list walkers. The flaw stems from two related races in ksmbd_durable_scavenger() - a list_head reuse that corrupts f_ci->m_fp_list and a refcount/unlink race that leaves a freed handle reachable by rename and share-mode lookups. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV, so exploitation is unproven despite the NVD 9.8 rating.

Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).

Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.

Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.

Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.

Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.

Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.

Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.

Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.

Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).

Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.

Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.

Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.

Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).

Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.

Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.

Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.

Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.

Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.

Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.

Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.

Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.

Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.

Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.

Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.

Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.

Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.

Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).

Use-after-free in the Linux kernel's 8250_dw (Synopsys DesignWare) serial driver arises when dw8250_probe() fails during clk_notifier_register(): the already-registered 8250 port is left occupying its slot while its devm-allocated driver data is freed, leaving stale private_data and serial_in/serial_out callbacks that reference freed memory. The flaw affects kernels from 5.9 through the fixed stable releases and is tagged as an information-disclosure risk; there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile). Despite an NVD CVSS of 9.8, exploitation is gated by a probe-failure error path in a specific UART driver, so real-world reachability is far narrower than the score implies.

Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).

Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when it redefines a previously declared anchor. The bug lives in the bundled libsyck C code (syck_hdlr_add_anchor), where an anchor name string is shared between a node's node->anchor field and the parser's anchors-table key; freeing the node frees the shared key, and a subsequent anchor redefinition makes st_delete/st_strcmp compare against freed heap memory. Any Perl application that calls Load or LoadFile on untrusted YAML is affected on the default code path (anchors need no special flags). Reported by CPANSec and disclosed via oss-security; publicly documented proof-of-concept trigger inputs exist, but there is no CISA KEV listing and no evidence of active exploitation.

Heap buffer over-read in the ngx_http_ssi_module of NGINX Open Source and NGINX Plus lets an unauthenticated man-in-the-middle attacker who can control upstream responses corrupt worker-process memory or crash the worker, but only in the non-default configuration combining Server-Side Includes, proxy_pass, and proxy_buffering off. The impact is confined to the data plane with no control-plane exposure, yielding limited memory modification and worker restarts (denial of service) rather than full code execution. No public exploit identified at time of analysis, though a vendor patch is available and the flaw carries a CVSS 4.0 score of 8.3.

Use-after-free in Google Chrome's UI component on Linux (versions prior to 150.0.7871.125) lets a remote attacker trigger heap corruption through a crafted HTML page, but only after luring the victim into performing specific UI gestures. Rated High severity by Chromium and CVSS 7.5, the flaw carries full confidentiality, integrity, and availability impact and could lead to code execution inside the renderer, though no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with the high attack complexity and required user interaction.

Sandbox escape in Google Chrome desktop and ChromeOS builds prior to 150.0.7871.125 stems from a use-after-free in the Skia graphics library, allowing a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Google rates this High severity; SSVC technical impact is 'total' with a scope change (S:C), but exploitation is not observed (no public exploit identified at time of analysis) and EPSS is low at 0.24%. A vendor patch is available.

Sandbox escape in Google Chrome on Windows (versions prior to 150.0.7871.125) stems from a use-after-free in the browser's Core component, letting a remote attacker who lures a user to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. The flaw is rated High by Chromium and carries a 9.6 CVSS due to scope change and full CIA impact, though it requires user interaction (visiting the page). There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none, with a low EPSS probability of 0.26%.

Sandbox escape in Google Chrome for Android (versions prior to 150.0.7871.125) stems from a use-after-free in the GPU process, allowing an attacker who has already compromised the renderer to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS of 8.3, it carries a scope-changing, total-impact profile but is gated by prior renderer compromise, and there is no public exploit identified at time of analysis. EPSS is low (0.24%, 16th percentile) and CISA SSVC records exploitation status as none.

Heap corruption in Google Chrome's Ozone graphics/windowing layer (versions prior to 150.0.7871.125) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free with total technical impact. Chromium rates the underlying bug Critical, though the CVSS is 7.5 because exploitation hinges on user interaction and high attack complexity. There is no public exploit identified at time of analysis, EPSS risk is low (0.30%, 22nd percentile), and CISA SSVC records exploitation status as none.

Heap corruption in Google Chrome's Ozone component on Linux (versions prior to 150.0.7871.125) allows a remote attacker to potentially execute arbitrary code within the browser process after luring a victim to a crafted HTML page and coaxing them into specific UI gestures. Chromium rated the flaw Critical severity, though its practical exploitability is tempered by the required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none'.

Local privilege escalation in the Microsoft Windows Client-Side Caching (CSC) Service, driven by a use-after-free (CWE-416) memory-corruption flaw affecting Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. An authorized attacker who already holds low-level privileges (PR:L) on the host can trigger the freed-object reuse to gain elevated, likely SYSTEM-level, privileges. The issue was reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and no CISA KEV listing.

Local privilege escalation in the Windows 11 (version 26H1) Desktop Window Manager (DWM) allows an authenticated low-privileged user to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption flaw. Reported by Microsoft and carrying a CVSS 3.1 score of 7.8, the flaw grants full confidentiality, integrity, and availability impact once triggered locally. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but DWM EoP bugs are a historically favored post-compromise primitive.

Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authenticated local attacker to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The CVSS 3.1 vector (AV:L/PR:L) confirms an already-authenticated low-privileged user is required, and full compromise of confidentiality, integrity, and availability follows successful exploitation. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privileges to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 (High), tempered by high attack complexity.

Remote code execution in Windows Remote Desktop Services (RDS) allows an authenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core). It was reported by Microsoft with a CVSS 8.8 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector combined with only low-privilege requirements makes it a strong patch priority.

Local privilege escalation in Microsoft Windows Sensor Data Service arises from a use-after-free (CWE-416) memory corruption flaw that an already-authenticated attacker can trigger to run code at higher privilege. It affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and the CVSS:3.1 score is 7.0 (High).

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level control. The flaw is a use-after-free (CWE-416) affecting a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Elevation of privilege in Microsoft Windows Management Services lets a low-privileged local user corrupt memory through a use-after-free (CWE-416) and gain higher privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A successful exploit yields high confidentiality, integrity, and availability impact, but the CVSS vector marks high attack complexity, reflecting the race-condition timing typically needed to win a use-after-free. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The flaw affects a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and was reported by Microsoft. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Local privilege escalation in Microsoft's NAT Helper Components (ipnathlp.dll), the driver behind Internet Connection Sharing and NAT translation on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. An authenticated attacker who already has low-privilege access can exploit a use-after-free memory corruption bug to run code at higher privilege (SYSTEM). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an already-authenticated user execute code in kernel context and gain SYSTEM-level rights, affecting a broad Windows client and server range from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. The flaw is a CWE-416 use-after-free that yields total technical impact (C:H/I:H/A:H). Microsoft has shipped a patch; there is no public exploit identified at time of analysis and CISA's SSVC framework lists exploitation as none, with a low EPSS of 0.25% (16th percentile).

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in the Windows SMB Server Network Transport driver (srvnet.sys) allows unauthenticated network attackers to run arbitrary code by triggering a use-after-free condition, affecting a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8 Critical), exploitation needs no authentication or user interaction, giving this the structural profile of a wormable SMB flaw similar to prior srvnet.sys issues. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as 'none', with a modest EPSS of 0.57% (43rd percentile).

Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2016 through 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N), the flaw grants full confidentiality, integrity, and availability impact on the local system. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Local privilege escalation in the Microsoft Windows Kernel (CWE-416 use-after-free) lets an already-authenticated low-privilege user corrupt kernel memory and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. Microsoft self-reported the flaw and has shipped a patch through the Update Guide; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a classic Patch-Tuesday local EoP suitable as a second-stage primitive after initial access.

Local privilege escalation in the Windows MIDI Service Module on Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free memory-corruption condition (CWE-416). Reported by Microsoft with a vendor patch already available; there is no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low at 0.25% (16th percentile), consistent with a locally-exploitable EoP that is not yet weaponized.

Local privilege escalation in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user elevate to higher privileges. Exploitation requires winning a race condition (high attack complexity), and Microsoft has released a fix; no public exploit identified at time of analysis. Rated CVSS 7.0 with full confidentiality, integrity, and availability impact once triggered.

Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). By triggering a use-after-free (CWE-416) memory-corruption condition, an already-authenticated low-privilege attacker can execute code in a higher-privilege context, yielding full confidentiality, integrity, and availability impact on the local system. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in Microsoft XML Core Services (MSXML) lets an already-authenticated user on affected Windows 10, Windows 11, and Windows Server systems corrupt memory via a use-after-free (CWE-416) and run code at elevated privilege. The flaw was reported by Microsoft and is patched; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.25% (16th percentile) exploitation probability. Impact is total (high confidentiality, integrity, and availability) but requires prior local access.

Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.

Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.

Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac) stems from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted document. Rated CVSS 7.8 with high confidentiality, integrity, and availability impact, exploitation requires user interaction but no prior authentication, letting an attacker run arbitrary code in the context of the current user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a fix, so patching should be prioritized during the normal Patch Tuesday cycle.

Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office for Mac 2021/2024) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a maliciously crafted Office document. Successful exploitation runs arbitrary code in the context of the current user, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Microsoft has published a patch via MSRC.

Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and the macOS editions) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an attacker run arbitrary code in the context of the current user after the victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high impact to confidentiality, integrity, and availability, and requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.

Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.

Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) stems from a use-after-free memory-corruption flaw (CWE-416). An attacker who convinces a user to open a specially crafted Office document can execute arbitrary code in the context of the current user, gaining full confidentiality, integrity, and availability impact. Exploitation requires user interaction (opening a malicious file) and there is no public exploit identified at time of analysis.

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw affecting a broad range of Windows 10, Windows 11, and Windows Server releases (Server 2012 through Server 2025). Per the CVSS vector an unauthenticated attacker with local access can achieve high-impact code execution with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch through the MSRC update guide.

Local privilege escalation in the Windows Clipboard Server (Cliprdr/RDP clipboard virtual channel service) affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through 11 26H1 and Server 2025). An authenticated local attacker who can trigger a use-after-free (CWE-416) in the service can corrupt memory to run code at elevated (SYSTEM-level) privilege. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.