CVE-2020-21913

icu: Use after free in pkg_createWithAssemblyCode function in tools/pkgdata/pkgdata.cpp

International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Unicode

Products

Debian Linux International Components For Unicode

CVE-2020-13871

sqlite: use-after-free in resetAccumulator in select.c

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Cloud Backup and 9 more

CVE-2020-13630

sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed

Vendors

Apple Broadcom Canonical and 7 more

Products

Icloud Ipados Iphone Os and 18 more

CVE-2020-11656

sqlite: use-after-free in the ALTER TABLE implementation

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

CVSS 3.1 · 9.8 Critical EPSS 8.7% KEV · Not listed

Vendors

Netapp Oracle Siemens and 2 more

Products

Ontap Select Deploy Administration Utility Communications Messaging Server Communications Network Charging And Control and 9 more

CVE-2020-1752

glibc: use-after-free in glob() function when expanding ~user

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnu and 2 more

Products

Ubuntu Linux Debian Linux Glibc and 7 more

CVE-2020-1712

systemd: use-after-free when asynchronous polkit queries are performed

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Redhat Systemd Project

Products

Debian Linux Ceph Storage Discovery and 5 more

CVE-2019-20795

iproute: use-after-free in get_netnsid_from_name in ip/ipnetns.c

iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Iproute2 Project

Products

Ubuntu Linux Iproute2

CVE-2019-5481

curl: double free due to subsequent call of realloc()

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed

Vendors

Debian Fedoraproject Haxx and 4 more

Products

Debian Linux Fedora Curl and 12 more

CVE-2019-5018

sqlite: Use-after-free in window function leading to remote code execution

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

CVSS 3.1 · 8.1 High EPSS 6.7% KEV · Not listed

Vendors

Canonical Redhat Sqlite

Products

Ubuntu Linux Enterprise Linux Sqlite

CVE-2016-5131

libxml2: Use after free triggered by XPointer paths beginning with range-to

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Iphone Os Mac Os X Tvos and 15 more

CVE-2016-4658

libxml2: Use after free via namespace node in XPointer ranges

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

CVSS 3.0 · 9.8 Critical EPSS 8.6% KEV · Not listed

Vendors

Apple Redhat Xmlsoft

Products

Iphone Os Mac Os X Tvos and 3 more

CVE-2016-3189

bzip2: heap use after free in bzip2recover

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

CVSS 3.1 · 6.5 Medium EPSS 15.7% KEV · Not listed

Vendors

Bzip Python

Products

Bzip2 Python

CVE-2026-109732

Use-after-free in the DOM: Streams component

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109741

Use-after-free in the Storage: Bucket File System component

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109761

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109765

Race condition, use-after-free in the Graphics: Text component

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-105725

Windows Security App Elevation of Privilege Vulnerability

Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Security App

CVE-2026-109717

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109724

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-100757

Use-after-free in the Widget component

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird