CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2014-1776"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-04-27T10:55:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014.  NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that \"VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks.\"",
  "id": "GHSA-44fv-7jv8-5cpp",
  "modified": "2025-10-22T03:30:37Z",
  "published": "2022-05-14T02:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1776"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-021"
    },
    {
      "type": "WEB",
      "url": "https://technet.microsoft.com/library/security/2963983"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1776"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-detection-script"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-mitigation-scripts"
    },
    {
      "type": "WEB",
      "url": "http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-0day.aspx"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/57908"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1030154"
    },
    {
      "type": "WEB",
      "url": "http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/222929"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/106311"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/67075"
    },
    {
      "type": "WEB",
      "url": "http://www.signalsec.com/cve-2014-1776-ie-0day-analysis"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T18:15:16Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: Disable the ncsi work before freeing the associated structure\n\nThe work function can run after the ncsi device is freed, resulting\nin use-after-free bugs or kernel panic.",
  "id": "GHSA-44g4-9qvp-9723",
  "modified": "2024-11-01T15:31:46Z",
  "published": "2024-10-21T18:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49945"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a0ffa68c70b367358b2672cdab6fa5bc4c40de2c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dd41dab62f32d9e9e0669af8459d12a93834b238"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6ca58696749268181f43150b3553f2bafd71e42"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10982"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:17:01Z",
    "severity": "HIGH"
  },
  "details": "Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-44jx-cc5r-6xx6",
  "modified": "2026-06-05T03:31:32Z",
  "published": "2026-06-05T00:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10982"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/513774197"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-6831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-01-19T05:59:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.",
  "id": "GHSA-44m9-gpqm-x8fj",
  "modified": "2022-05-17T00:28:14Z",
  "published": "2022-05-17T00:28:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6831"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=70155"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=70166"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=70168"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=70169"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201606-10"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2015/dsa-3344"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/08/19/3"
    },
    {
      "type": "WEB",
      "url": "http://www.php.net/ChangeLog-5.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/76737"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-32073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T18:17:08Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-44pc-wvm3-296c",
  "modified": "2026-04-14T18:30:39Z",
  "published": "2026-04-14T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32073"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-21860"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-02T07:15:11Z",
    "severity": "HIGH"
  },
  "details": "\nin OpenHarmony v4.0.0 and prior versions\n\nallow an adjacent attacker arbitrary code execution in any apps through use after free.",
  "id": "GHSA-44qh-gw8j-g2gv",
  "modified": "2024-02-02T09:30:22Z",
  "published": "2024-02-02T09:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21860"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-21384"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-13T18:15:56Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Office OneNote Remote Code Execution Vulnerability",
  "id": "GHSA-44vv-2mpg-8hv5",
  "modified": "2024-02-13T18:38:24Z",
  "published": "2024-02-13T18:38:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21384"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21384"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-7879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-12-15T06:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.",
  "id": "GHSA-44w8-g2pc-jwwm",
  "modified": "2022-05-14T02:21:35Z",
  "published": "2022-05-14T02:21:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7879"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/flash-player/apsb16-39.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201701-17"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2947.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94873"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1037442"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-619"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2930"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-30T22:15:10Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-44xq-533g-gj79",
  "modified": "2023-11-25T12:30:21Z",
  "published": "2023-05-31T00:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2930"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1443401"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202311-11"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202401-34"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5418"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-02T16:15:27Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvp_vdpa: fix the crash in hot unplug with vp_vdpa\n\nWhile unplugging the vp_vdpa device, it triggers a kernel panic\nThe root cause is: vdpa_mgmtdev_unregister() will accesses modern\ndevices which will cause a use after free.\nSo need to change the sequence in vp_vdpa_remove\n\n[  195.003359] BUG: unable to handle page fault for address: ff4e8beb80199014\n[  195.004012] #PF: supervisor read access in kernel mode\n[  195.004486] #PF: error_code(0x0000) - not-present page\n[  195.004960] PGD 100000067 P4D 1001b6067 PUD 1001b7067 PMD 1001b8067 PTE 0\n[  195.005578] Oops: 0000 1 PREEMPT SMP PTI\n[  195.005968] CPU: 13 PID: 164 Comm: kworker/u56:10 Kdump: loaded Not tainted 5.14.0-252.el9.x86_64 #1\n[  195.006792] Hardware name: Red Hat KVM/RHEL, BIOS edk2-20221207gitfff6d81270b5-2.el9 unknown\n[  195.007556] Workqueue: kacpi_hotplug acpi_hotplug_work_fn\n[  195.008059] RIP: 0010:ioread8+0x31/0x80\n[  195.008418] Code: 77 28 48 81 ff 00 00 01 00 76 0b 89 fa ec 0f b6 c0 c3 cc cc cc cc 8b 15 ad 72 93 01 b8 ff 00 00 00 85 d2 75 0f c3 cc cc cc cc \u003c8a\u003e 07 0f b6 c0 c3 cc cc cc cc 83 ea 01 48 83 ec 08 48 89 fe 48 c7\n[  195.010104] RSP: 0018:ff4e8beb8067bab8 EFLAGS: 00010292\n[  195.010584] RAX: ffffffffc05834a0 RBX: ffffffffc05843c0 RCX: ff4e8beb8067bae0\n[  195.011233] RDX: ff1bcbd580f88000 RSI: 0000000000000246 RDI: ff4e8beb80199014\n[  195.011881] RBP: ff1bcbd587e39000 R08: ffffffff916fa2d0 R09: ff4e8beb8067ba68\n[  195.012527] R10: 000000000000001c R11: 0000000000000000 R12: ff1bcbd5a3de9120\n[  195.013179] R13: ffffffffc062d000 R14: 0000000000000080 R15: ff1bcbe402bc7805\n[  195.013826] FS:  0000000000000000(0000) GS:ff1bcbe402740000(0000) knlGS:0000000000000000\n[  195.014564] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  195.015093] CR2: ff4e8beb80199014 CR3: 0000000107dea002 CR4: 0000000000771ee0\n[  195.015741] PKRU: 55555554\n[  195.016001] Call Trace:\n[  195.016233]  \u003cTASK\u003e\n[  195.016434]  vp_modern_get_status+0x12/0x20\n[  195.016823]  vp_vdpa_reset+0x1b/0x50 [vp_vdpa]\n[  195.017238]  virtio_vdpa_reset+0x3c/0x48 [virtio_vdpa]\n[  195.017709]  remove_vq_common+0x1f/0x3a0 [virtio_net]\n[  195.018178]  virtnet_remove+0x5d/0x70 [virtio_net]\n[  195.018618]  virtio_dev_remove+0x3d/0x90\n[  195.018986]  device_release_driver_internal+0x1aa/0x230\n[  195.019466]  bus_remove_device+0xd8/0x150\n[  195.019841]  device_del+0x18b/0x3f0\n[  195.020167]  ? kernfs_find_ns+0x35/0xd0\n[  195.020526]  device_unregister+0x13/0x60\n[  195.020894]  unregister_virtio_device+0x11/0x20\n[  195.021311]  device_release_driver_internal+0x1aa/0x230\n[  195.021790]  bus_remove_device+0xd8/0x150\n[  195.022162]  device_del+0x18b/0x3f0\n[  195.022487]  device_unregister+0x13/0x60\n[  195.022852]  ? vdpa_dev_remove+0x30/0x30 [vdpa]\n[  195.023270]  vp_vdpa_dev_del+0x12/0x20 [vp_vdpa]\n[  195.023694]  vdpa_match_remove+0x2b/0x40 [vdpa]\n[  195.024115]  bus_for_each_dev+0x78/0xc0\n[  195.024471]  vdpa_mgmtdev_unregister+0x65/0x80 [vdpa]\n[  195.024937]  vp_vdpa_remove+0x23/0x40 [vp_vdpa]\n[  195.025353]  pci_device_remove+0x36/0xa0\n[  195.025719]  device_release_driver_internal+0x1aa/0x230\n[  195.026201]  pci_stop_bus_device+0x6c/0x90\n[  195.026580]  pci_stop_and_remove_bus_device+0xe/0x20\n[  195.027039]  disable_slot+0x49/0x90\n[  195.027366]  acpiphp_disable_and_eject_slot+0x15/0x90\n[  195.027832]  hotplug_event+0xea/0x210\n[  195.028171]  ? hotplug_event+0x210/0x210\n[  195.028535]  acpiphp_hotplug_notify+0x22/0x80\n[  195.028942]  ? hotplug_event+0x210/0x210\n[  195.029303]  acpi_device_hotplug+0x8a/0x1d0\n[  195.029690]  acpi_hotplug_work_fn+0x1a/0x30\n[  195.030077]  process_one_work+0x1e8/0x3c0\n[  195.030451]  worker_thread+0x50/0x3b0\n[  195.030791]  ? rescuer_thread+0x3a0/0x3a0\n[  195.031165]  kthread+0xd9/0x100\n[  195.031459]  ? kthread_complete_and_exit+0x20/0x20\n[  195.031899]  ret_from_fork+0x22/0x30\n[  195.032233]  \u003c/TASK\u003e",
  "id": "GHSA-4534-9h9q-hvrh",
  "modified": "2025-11-12T21:31:00Z",
  "published": "2025-05-02T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53082"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aed8efddd39b3434c96718d39009285c52b1cafc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/baafa2960731211837d8fc04ff3873ecb7440464"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fa1f327f93c9a7310cce9d2fcda28b7af91f7437"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}