Common Weakness Enumeration
CWE-825
AllowedExpired Pointer Dereference
Abstraction: Base · Status: Incomplete
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
122 vulnerabilities reference this CWE, most recent first.
GHSA-MWCC-7VPP-XMV9
Vulnerability from github – Published: 2025-11-19 00:31 – Updated: 2026-03-24 14:41
VLAI
Summary
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
Details
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
Severity
6.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "mongodb/mongodb-extension"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12119"
],
"database_specific": {
"cwe_ids": [
"CWE-825"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-19T18:54:37Z",
"nvd_published_at": "2025-11-18T22:15:45Z",
"severity": "MODERATE"
},
"details": "A mongoc_bulk_operation_t may read invalid memory if large options are passed.",
"id": "GHSA-mwcc-7vpp-xmv9",
"modified": "2026-03-24T14:41:29Z",
"published": "2025-11-19T00:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12119"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-c-driver/commit/775998df7c67"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-php-driver/commit/fa5b43366407bc0e5b0a919ed374decd9022b2f9"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/mongo-php-driver"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/PHPC-2637"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "MongoDB driver extension affected by mongoc_bulk_operation_t\u0027s read of invalid memory"
}
GHSA-PG25-7CX5-CVCM
Vulnerability from github – Published: 2026-04-13 18:30 – Updated: 2026-08-10 15:33
VLAI
Details
Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-6100"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-13T18:16:31Z",
"severity": "CRITICAL"
},
"details": "Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
"id": "GHSA-pg25-7cx5-cvcm",
"modified": "2026-08-10T15:33:13Z",
"published": "2026-04-13T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/148395"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/148396"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26187"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25096"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21682"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19590"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19576"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10117"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:52400"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8822"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8824"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9228"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-6100"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10140"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10141"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10711"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10745"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10774"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10949"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10950"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11062"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11768"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13692"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13812"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14652"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14653"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14656"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17525"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17619"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19019"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19064"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19175"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19176"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19216"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19570"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19571"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/13/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PHWJ-RPRQ-35PP
Vulnerability from github – Published: 2026-06-19 16:37 – Updated: 2026-06-19 16:37
VLAI
Summary
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
Details
Summary
Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.
Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.
JRuby is not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via Attr#value= or #content=. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.
Mitigation
Upgrade to Nokogiri 1.19.4 or later.
As a workaround, avoid accessing attribute child nodes directly via Attr#child or similar before mutating the same attribute’s value.
Credit
This issue was responsibly reported by Zheng Yu from depthfirst.com.
Severity
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T16:37:46Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nNokogiri\u2019s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.\n\nNokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute\u0027s child node and then replace that same attribute\u0027s value via `Attr#value=` or `#content=`. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.4 or later.\n\nAs a workaround, avoid accessing attribute child nodes directly via `Attr#child` or similar before mutating the same attribute\u2019s value.\n\n### Credit\n\nThis issue was responsibly reported by Zheng Yu from depthfirst.com.",
"id": "GHSA-phwj-rprq-35pp",
"modified": "2026-06-19T16:37:46Z",
"published": "2026-06-19T16:37:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nokogiri"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`"
}
GHSA-PP4W-C8M6-4XVF
Vulnerability from github – Published: 2026-06-15 18:31 – Updated: 2026-06-30 03:37
VLAI
Details
A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-6040"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T18:16:36Z",
"severity": "MODERATE"
},
"details": "A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.",
"id": "GHSA-pp4w-c8m6-4xvf",
"modified": "2026-06-30T03:37:04Z",
"published": "2026-06-15T18:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6040"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-6040"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488966"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6040.json"
},
{
"type": "WEB",
"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-6040"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PQXF-3WQ6-69F8
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-30 03:36
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: use safe list iteration in radar detect work
The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-46166"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:32Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list. Guard against this to avoid a\nslab-use-after-free error.",
"id": "GHSA-pqxf-3wq6-69f8",
"modified": "2026-06-30T03:36:52Z",
"published": "2026-05-28T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46166"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33215"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-46166"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482645"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46166.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PVQQ-PW2J-4V86
Vulnerability from github – Published: 2026-07-27 12:31 – Updated: 2026-09-09 09:32
VLAI
Details
A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-17523"
],
"database_specific": {
"cwe_ids": [
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T10:16:36Z",
"severity": "HIGH"
},
"details": "A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.",
"id": "GHSA-pvqq-pw2j-4v86",
"modified": "2026-09-09T09:32:57Z",
"published": "2026-07-27T12:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17523"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55764"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55765"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:61932"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-17523"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507407"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/79305a826f872fe446c6fbf8450f515053ef6951"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q3JJ-75H6-5XMP
Vulnerability from github – Published: 2026-09-28 21:31 – Updated: 2026-10-02 03:31
VLAI
Details
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Severity
7.0 (High)
{
"affected": [],
"aliases": [
"CVE-2026-102010"
],
"database_specific": {
"cwe_ids": [
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-28T19:16:48Z",
"severity": "HIGH"
},
"details": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.",
"id": "GHSA-q3jj-75h6-5xmp",
"modified": "2026-10-02T03:31:09Z",
"published": "2026-09-28T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102010"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:73642"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:74569"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-102010"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478395"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q6V9-43V5-JV9Q
Vulnerability from github – Published: 2026-06-19 20:46 – Updated: 2026-06-19 20:46
VLAI
Summary
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Details
Impact
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.
Severity
6.2 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "CoreWCF.UnixDomainSocket"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "CoreWCF.UnixDomainSocket"
},
"ranges": [
{
"events": [
{
"introduced": "1.9.0"
},
{
"fixed": "1.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54778"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-825"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T20:46:58Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nRace condition in POSIX peer identity resolution may attribute one connection\u2019s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.",
"id": "GHSA-q6v9-43v5-jv9q",
"modified": "2026-06-19T20:46:58Z",
"published": "2026-06-19T20:46:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q"
},
{
"type": "PACKAGE",
"url": "https://github.com/CoreWCF/CoreWCF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution"
}
GHSA-QG4C-8PJ4-QGW2
Vulnerability from github – Published: 2025-06-16 18:32 – Updated: 2026-09-28 03:30
VLAI
Details
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-49794"
],
"database_specific": {
"cwe_ids": [
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-16T16:15:18Z",
"severity": "CRITICAL"
},
"details": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0027s crash using libxml or other possible undefined behaviors.",
"id": "GHSA-qg4c-8pj4-qgw2",
"modified": "2026-09-28T03:30:23Z",
"published": "2025-06-16T18:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18240"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19020"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19894"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21913"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0934"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:62549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-49794"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10698"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:11580"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12098"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12099"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12199"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12237"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12239"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12240"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12241"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:13335"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15397"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15827"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15828"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18218"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R37M-3HW5-974W
Vulnerability from github – Published: 2026-04-21 15:32 – Updated: 2026-06-30 03:36
VLAI
Details
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-6746"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-21T13:16:20Z",
"severity": "HIGH"
},
"details": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10.",
"id": "GHSA-r37m-3hw5-974w",
"modified": "2026-06-30T03:36:19Z",
"published": "2026-04-21T15:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6746"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10757"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19465"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19466"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19467"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19468"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19469"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19542"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19655"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19704"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-6746"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014596"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460112"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6746.json"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-30"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-31"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-32"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-33"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-34"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10766"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10767"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:12285"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13537"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:15892"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17477"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17687"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17688"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17689"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19131"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19201"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19348"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19463"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19464"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Choose a language that provides automatic memory management.
Mitigation
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.