VVdeC before 3.2.1 has heap use-after-free (CVE-2026-124307)
A crafted VVC bitstream that redefines an ALF APS can hit freed memory; the fix commit is 1eddb30.
Stories per day · 30 days
16 RSS
Relatedchrome18google15linux-kernel15zero-day9browser8rce8remote-code-execution8ubuntu8zdi8gpac7mp4box7php7kernel6cwe-4165memory-corruption5mptcp5patch5privilege-escalation5
109 stories, newest first · one card per story
Stories tagged #use-after-free
Microsoft reports 59 Linux kernel bugs and 33 CVEs from AI scans
Eight CVEs had lab-confirmed local root exploits; fixes for 38 reports are in mainline, and bugs averaged 8.1 years old.
Google patches exploited Chrome zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
Chrome patches exploited XML use-after-free zero-day CVE-2026-125350
The XML use-after-free is Chrome’s eighth zero-day this year; CISA wants users patched before November 24.
Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
Google patches in-the-wild Chrome XML zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 close nine flaws; Google has not confirmed code execution or named attackers.
Google fixes exploited Chrome XML use-after-free zero-day CVE-2026-125350
Stable builds 157.0.8103.50/.51 close the high-severity bug; Google is withholding details until most users update.
Trimble SketchUp SKP parsing use-after-free allows remote code execution
ZDI rates CVE-2026-121741 at CVSS 7.8; the target must open a malicious file or visit a malicious page.
unixODBC <=2.3.14 Multiple Races
Data races in connection-pooling state data and races between teardown and error-handling can cause double-frees and use-after-frees.
Ashlar-Vellum Cobalt XE file parsing use-after-free enables remote code execution (CVE-2026-121753)
ZDI-26-872 discloses a use-after-free in Ashlar-Vellum Cobalt XE file parsing that enables arbitrary code execution with user interaction.
Ubuntu kernel update fixes Bluetooth use-after-free flaw
CVE-2021-3640 can crash the system or possibly run code locally; CVE-2022-49058 is also fixed.
Ubuntu Azure CVM kernel update fixes AX.25 use-after-free
A local attacker can crash the system via CVE-2022-1205; other listed flaws could compromise the system.
Linux kernel TCP UAF CVE-2026-98432 rated Critical
Anthropic researcher reported a PoC for remote root access on Linux servers with multipath TCP listeners.
3
Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
2
Go team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
Linux MPTCP flaw enables remote root; Anthropic shows exploit (CVE-2026-98432)
The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.
4
Linux kernel TCP use-after-free CVE-2026-98432 can crash Ubuntu
Ubuntu lists kernels through 22.04 LTS as affected, with fixes still in progress and no confirmed exploitation.
2
Linux TCP use-after-free CVE-2026-98432 yields lab remote root
Upstream CVSS is 9.8 and Red Hat scores 5.9; Anthropic’s root chain used a lab Multipath TCP listener.
1
GPAC MP4Box AC-4 cleanup use-after-free disclosed as CVE-2025-60482
The confirmed build is 2.5-DEV-rev1593-gfe88c3545-master; CISA ADP scores it 5.5 for local availability impact only.
Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
6
Claude research model wrote a root exploit for Linux CVE-2026-98432
Anthropic calls it a lab test, not a real incident; upstream kernels are patched but several Ubuntu releases remain vulnerable.
4
Linux kernel XFRM use-after-free allows local privilege escalation
ZDI rates CVE-2026-98231 at CVSS 7.8; low-privileged local code execution is required first.
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
Chrome 156 and Firefox 159 patch critical memory-safety flaws
Google shipped 52 fixes, four rated Critical, and Mozilla fixed 167 bugs; both credited AI-assisted bug finding.