CWE-415
CWE-415 · 64 records · 22 with a public proof-of-concept
Records the NVD classes under CWE-415, highest CVSS first.
- CRITICAL 9.9CVE-2026-89078
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due …
gitlab
- CRITICAL 9.8CVE-2026-58968
In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CRITICAL 9.8CVE-2026-97749
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- CRITICAL 9.8CVE-2026-96864
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-5759public PoC
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for e…
- CRITICAL 9.6CVE-2026-104192public PoC
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared o…
- HIGH 8.8CVE-2026-85890
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
edge chromium
- HIGH 8.8CVE-2026-83831
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
edge
- HIGH 8.8CVE-2026-97772
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97767
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-85936
Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70158
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
- HIGH 8.8CVE-2026-91018public PoC
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
- HIGH 8.1CVE-2026-94300
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…
- HIGH 8.1CVE-2026-88171
Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- HIGH 8.1CVE-2026-84012
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- HIGH 8.1CVE-2026-70062
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
- HIGH 7.8CVE-2026-92211public PoC
Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library i…
- HIGH 7.8CVE-2026-119116public PoC
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro E…
- HIGH 7.8CVE-2026-88812
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
- HIGH 7.8CVE-2026-95635
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user inte…
- HIGH 7.8CVE-2026-97811
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-88071
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h2 · windows server 2022 · windows server 2025
- HIGH 7.8CVE-2026-85829
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83634
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-47558public PoC
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, esc…
- HIGH 7.8CVE-2026-6794
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
concert · linux kernel
- HIGH 7.5CVE-2026-121956public PoC
FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a cr…
freerdp
- HIGH 7.5CVE-2026-97830
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022
- HIGH 7.3CVE-2026-116260
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The e…
- HIGH 7.1CVE-2026-112457
A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process m…
macos
- HIGH 7.1CVE-2026-110599public PoC
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream …
- HIGH 7CVE-2026-125269public PoC
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientatio…
- HIGH 7CVE-2026-97812
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1
- HIGH 7CVE-2026-95943
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-88149
Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85904
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-83916
Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
- HIGH 7CVE-2026-83842
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-108132
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.7CVE-2026-20582
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID…
- MEDIUM 6.7CVE-2026-20573
In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID…
- MEDIUM 6.5CVE-2026-109943public PoC
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious…
- MEDIUM 6.2CVE-2026-20532
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168.
- MEDIUM 5.9CVE-2026-121507
Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure
- MEDIUM 5.9CVE-2026-109257public PoC
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to…
- MEDIUM 5.9CVE-2026-107209public PoC
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to fr…
- MEDIUM 5.7CVE-2026-17050public PoC
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DES…
- MEDIUM 5.5CVE-2026-116743public PoC
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered pa…
- MEDIUM 5.5CVE-2026-86962
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause …
- MEDIUM 5.3CVE-2026-57446public PoC
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale n…
- MEDIUM 5.2CVE-2026-78116public PoC
The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_…
- MEDIUM 4.8CVE-2026-108104public PoC
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trig…
- MEDIUM 4.3CVE-2026-112036
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. T…
- LOW 3.7CVE-2026-109271public PoC
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditi…
- LOW 2.3CVE-2026-106175
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through…
- LOW 2.3CVE-2026-107886public PoC
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class re…
- UNSCOREDCVE-2026-68994
A double free vulnerability in NPU driver due to improper pointer management (941)
- UNSCOREDCVE-2026-68993
A double free vulnerability in NPU driver due to improper pointer management (940)
- UNSCOREDCVE-2026-119338public PoC
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an …
- UNSCOREDCVE-2026-94370
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string t…
- UNSCOREDCVE-2026-95702public PoC
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an i…
- UNSCOREDCVE-2026-104113public PoC
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees t…
- UNSCOREDCVE-2026-11388
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.