CVE & Exploit Intelligence Database

CVE-2026-21237 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

CWE-416 Feb 10, 2026

CVE-2026-21235 7.3 HIGH EPSS 0.00

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CWE-416 Feb 10, 2026

CVE-2025-15570 5.3 MEDIUM 1 Writeup EPSS 0.00

A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE-119 Feb 10, 2026

CVE-2026-24684 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24683 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24681 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24680 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24678 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24677 9.1 CRITICAL 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24676 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24675 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24491 7.5 HIGH 1 Writeup EPSS 0.00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.

CWE-416 Feb 09, 2026

CVE-2026-24927 5.5 MEDIUM EPSS 0.00

Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-416 Feb 06, 2026

CVE-2026-24930 8.4 HIGH EPSS 0.00

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-416 Feb 06, 2026

CVE-2026-24917 6.5 MEDIUM EPSS 0.00

UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-416 Feb 06, 2026

CVE-2026-24914 4.0 MEDIUM EPSS 0.00

Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-416 Feb 06, 2026

CVE-2026-1979 5.3 MEDIUM 1 Writeup EPSS 0.00

A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.

CWE-119 Feb 06, 2026

CVE-2026-25507 6.3 MEDIUM 1 Writeup EPSS 0.00

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocomm_ble) layer. The issue can be triggered by a remote BLE client while the device is in provisioning mode. The vulnerability occurred when provisioning was stopped with keep_ble_on = true. In this configuration, internal protocomm_ble state and GATT metadata were freed while the BLE stack and GATT services remained active. Subsequent BLE read or write callbacks dereferenced freed memory, allowing a connected or newly connected client to trigger invalid memory acces. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

CWE-416 Feb 04, 2026

CVE-2025-47398 7.8 HIGH EPSS 0.00

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

CWE-416 Feb 02, 2026

CVE-2025-47359 7.8 HIGH EPSS 0.00

Memory Corruption when multiple threads simultaneously access a memory free API.

CWE-416 Feb 02, 2026