29 results for “Use-after-free”

lnd v0.20.7 and v0.21.6 are Lightning Network Daemon releases announced by Clio Bitcoin Bank. They include a Go-specific mitigation, with the MPTCP flag turned off, for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code. The post recommends all users update. It gives no exploit or impact detail.

x.comadvisoryPublished and added 31 Oct 2026🛡️ Security

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path: a request socket's ireq_opt pointer moves to the child socket as inet_opt and is freed with kfree() while a retransmitted-SYN CPU still reads it under RCU. The fix (commit e3f33b0a1d89) uses kfree_rcu(). The page covers CVSS 9.8 versus vendor scores, Anthropic's MPTCP root-exploit lab demo, per-distribution patch checks, MPTCP listener inventory and detection guidance. The page was truncated before its mitigation section.

penligent.aiarticleAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

CVE-2026-98432 is a Linux kernel use-after-free in the IPv4 TCP stack, tracked by Ubuntu (published 15 October 2026, updated 29 October 2026). ireq_opt/inet_opt were freed with plain kfree() while another CPU built a SYNACK under RCU, so ip_options_build() read freed memory; the fix uses kfree_rcu(). Ubuntu rates it High priority, CVSS v3.1 9.8 and v4.0 8.3. The page text does not list per-release package status.

ubuntu.comadvisoryAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

DailyDarkWeb post summarising Anthropic Frontier Red Team research published 27 October 2026. An unreleased internal Claude research model built five attack chains: Chrome sandbox escape (V8 heap bug, CacheStorage race, FedCM use-after-free), a Safari same-origin policy bypass, data extraction from a locked Pixel 9 over USB, a Windows QUIC kernel crash (CVE-2026-33096) and zero-click Linux root via multipath TCP (CVE-2026-98432). Anthropic says all flaws are fixed, including 62 Chrome CVEs as of Chrome 156. The post notes the chains are not independently reproduced.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Chrome 156 and Firefox 159 security updates fix over 200 vulnerabilities. Chrome 156 patches 52 flaws, four critical, including CVE-2026-118306, a FileSystem memory corruption bug that allows code execution outside the sandbox via a crafted HTML page. Firefox 159 fixes 167 flaws, 108 high severity, mostly use-after-free, plus Thunderbird and ESR releases. No in-the-wild exploitation is reported.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

Social post summarising emergency patches for Node.js (4 high CVEs), PHP (2 critical) and nginx (3 critical). Node.js flaws include a Brotli decoder out-of-bounds write, a DNS truncation bug and two TLS hostname-verification bypasses. PHP has use-after-free and heap corruption bugs, and nginx has alias-rewrite and map-regex heap overflows plus an SSI-AIO use-after-free. It lists the fixed versions for each product.

x.comthreadAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

Snyk's write-up of two critical unauthenticated PHP runtime RCEs, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state, cross-request use-after-free), both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the disclosure timeline, affected SAPIs (mod_php most exposed), backports for 8.1 and older, and partial mitigations.

snyk.ioadvisoryPublished and added 22 Oct 2026🛡️ Security

PHP2Shell is Wiz Research's disclosure of memory-safety bugs in core PHP, grouped under two CVEs (up to CVSS 9.2) and fixed in patched releases on 21 October 2026. The post details four bugs, all triggered by out-of-memory fatal errors that leave stale state: an upload-progress unserializer use-after-free, a session-ID memory disclosure, a fatal-error backtrace use-after-free and an OPcache type confusion. It describes unauthenticated RCE on WordPress, Drupal and Joomla, plus detection signals and a disclosure timeline.

wiz.iowriteupPublished and added 21 Oct 2026🛡️ Security

Chrome 156 reached the stable channel with fixes for 353 vulnerabilities, including six critical and 61 high-severity flaws. Memory safety dominates: 163 memory corruption, 125 use-after-free and 17 out-of-bounds read bugs. Google reports no in-the-wild exploitation. 285 bugs earned no bounty, including those found by Anthropic's Xinyang Ge with Claude and by OpenAI Codex Security. Builds are 156.0.8078.47/.48.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is the name given to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each), that could allow unauthenticated remote code execution. Details leaked before PHP's planned patch release on 21 October 2026 at 14:00 UTC. Reports say all versions from PHP 5 onward are affected and one flaw may be a use-after-free; watchTowr reproduced CVE-2026-109618, and Sansec expects mass exploitation within 15 minutes of the patch.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is Datadog Security Labs' analysis of two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), disclosed 21 October 2026. It walks through a reproduced exploit on PHP 8.5.11 (heap grooming, a fake array, and a destructor calling system()) and the stale-state use-after-free. It lists fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12), partial mitigations, and detection signals across requests, error logs and shell child processes.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 21 Oct 2026🛡️ Security

SecurityWeek covers Chrome 155.0.8059.79/.80, which fixes 37 flaws including seven critical memory bugs (an ANGLE buffer overflow and use-after-free bugs in Browser, PDF, Network, Core, SVG and Media). It also covers Firefox 158, which fixes 77 flaws including 30 high-severity use-after-free, sandbox escape, JIT miscompilation and integer overflow bugs, plus matching Thunderbird and Firefox ESR releases. At least 15 of the Chrome bugs were reported by Xinyang Ge (Anthropic) assisted by Claude, and Amy Burnett of OpenAI found 9 Firefox bugs. The article also notes Mozilla's new Firefox Enterprise, a Gecko-based browser with a self-hosted management console for policy, access, data transfer and AI use.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

CVE-2026-92392 is a use-after-free in curl's HTTP/2 upload path, fixed in curl 8.23.0 and rated HIGH. After a server zeroes the window and resets the stream, a dangling easy-handle pointer survives. On multi handle cleanup, server data lands in the freed memory and can overwrite a function pointer, giving remote code execution. Daniel Stenberg lists why exploitation is hard (~135KB upload, ~23-byte payload, allocation-dependent) and says Luna Tong at Anthropic found it with an OSS Scanner.

daniel.haxx.searticleAdded 23 Oct 2026, published 14 Oct 2026🛡️ Security

Google is raising Chrome Vulnerability Reward Program payouts for memory safety bugs. The base rate goes from $500 to $2,000, with up to $20,000 for browser, GPU and network process bugs and up to $8,000 for renderer use-after-free and memory write bugs. V8 sandbox bugs move to a flat $5,000 and V8 logic bugs to $4,000. A $2,000 fuzzer bonus returns, and submissions made after April 30, 2026 are rewarded under the new rules. The rates are still well below the pre-April 2026 levels. The article also notes that Google temporarily closed the OSS VRP to product vulnerability submissions because of a flood of AI-generated reports.

securityweek.comarticlePublished and added 13 Oct 2026🛡️ Security

Cisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs — NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.

blog.talosintelligence.comadvisoryPublished and added 7 Oct 2026🛡️ Security

Chrome 155 security update fixes 247 vulnerabilities, including four critical use-after-free bugs in Chromecast, Browser, Navigation and Track (CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, CVE-2026-106347). Researcher Xinyang Ge reported three of them and used AI to find two. It also fixes 53 high-severity bugs; Google paid about $33,000 in bounties and reports no exploitation in the wild. Fixed builds are 155.0.8059.39/.40.

securityweek.comarticlePublished and added 7 Oct 2026🛡️ Security

Zafran Security disclosed four vulnerabilities (dubbed DifyTap) in the open-source agentic workflow platform Dify, including two critical authorization bypass/path-traversal bugs (CVE-2026-41947, CVE-2026-41948) letting attackers redirect app traces to an attacker-controlled LLM provider or reach Dify's internal Plugin Daemon API, plus two file-preview authz flaws (CVE-2026-41949, CVE-2026-41950) exposing other tenants' uploaded documents and chat files via UUID guessing. Separately, Dify's file-parsing stack bundled a version of PDFium vulnerable to CVE-2024-5846, a use-after-free that can trigger heap corruption via a crafted PDF. All but CVE-2026-41948 were patched in Dify 1.14.2.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

Depth First researchers detail CVE-2026-80521, a Linux kernel use-after-free in the AF_UNIX subsystem's garbage collector (a race between edge visibility during SCM_RIGHTS sends and vertex freeing in unix_del_edge/unix_walk_scc_fast), discovered with their in-house AI vulnerability-detection model dfs-large1 and used to win a Google kernelCTF slot. They released a working container-escape exploit against the latest Ubuntu 26.04, plus a second exploit for CVE-2026-52910 against Ubuntu 24.04, arguing that AI-accelerated bug discovery has broken the assumption that shared-kernel containers (Docker/Kubernetes, nsjail, Firejail, Bubblewrap) provide a hard security boundary, and recommending migration of sensitive workloads to microVM isolation like Firecracker or Kata Containers.

depthfirst.comwriteupAdded 26 Sep 2026, published 22 Sep 2026🛡️ Security

Endor Labs guide to C/C++ memory-safety and input-handling vulnerabilities — buffer overflow (CWE-787/120/121), use-after-free (CWE-416), null pointer dereference (CWE-476), integer overflow (CWE-190), and format string bugs (CWE-134) — with vulnerable/fixed code snippets for each. It surveys detection tooling (Coverity, CodeQL, Clang Static Analyzer, AFL++/libFuzzer with ASan/UBSan, OSS-Fuzz) and argues that build-system complexity (Bazel, CMake, Conan, vcpkg) and high SAST false-positive rates make reachability analysis necessary, closing with a pitch for Endor Labs' AURI reachability engine.

endorlabs.comarticlePublished and added 11 Sep 2026🛡️ Security

Adversa AI's September 2026 roundup of 15 GenAI security resources, grouped by attack technique, defense, threat modeling, red teaming, and training. Highlights include the OWASP LLM Top 10 2026 update (now blending 75% expert consensus with 25% incident data from 6,639 vulnerabilities, with eight of ten entries moving and System Prompt Leakage renamed Hidden Context Exposure), a memory-safety audit finding 10 vulnerabilities (including two use-after-frees at CVSS 9.2/8.1) in the C/C++ inference engine underlying Ollama, LM Studio, Jan and GPT4All, and research on stealing reasoning traces from proprietary LLM APIs, RAG document poisoning, and attention-collapse-based poisoning detection (D-SCAN).

adversa.aiarticleAdded 7 Oct 2026, published 9 Sep 2026🛡️ Security

Cisco Talos's analysis of Microsoft's September 2026 Patch Tuesday release, covering 973 vulnerabilities (113 critical, 82 of those RCE). Two flaws are confirmed exploited in the wild — CVE-2026-81963 (Windows Update Stack elevation of privilege) and CVE-2026-85880 (Windows ALPC elevation of privilege) — alongside a long list Microsoft rates "more likely" to be exploited, including a Windows Kerberos auth-bypass-by-replay RCE (CVE-2026-69676) and a Windows DNS Server use-after-free RCE (CVE-2026-69730). Talos releases accompanying Snort 2/3 rule coverage (SIDs 67011-67084, 301619-301655) to detect exploitation attempts.

blog.talosintelligence.comadvisoryAdded 7 Oct 2026, published 8 Sep 2026🛡️ Security

Orca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.

orca.securityadvisoryPublished and added 12 Aug 2026🛡️ Security

GitHub repo (sgkdev/bad_garbage) containing a proof-of-concept exploit for CVE-2026-53361, an unprivileged, container-escapable use-after-free in the Linux AF_UNIX socket garbage collector. The bug stems from a race where a concurrent MSG_PEEK on an in-flight socket slips past the gc_in_progress check, letting the GC free a still-referenced socket; the same underlying race has been patched three separate times (CVE-2021-0920, CVE-2026-23394, CVE-2026-53361). The PoC targets systems with 2–7 CPUs and notes that most SLUB cache-armoring/shadowing code was stripped out, leaving occasional collisions in kmalloc-64/anon_vma caches that a user would need to re-armor for near-100% reliability.

github.comrepoAdded 2 Oct 2026, published 10 Aug 2026🛡️ Security

A "battle-tested" collection of Semgrep rules by researcher 0xdea aimed at C (and some C++) vulnerability hunting, covering buffer overflows, use-after-free/double-free, format string bugs, integer truncation/wraparound, command injection, insecure APIs (gets, strcpy, sprintf, scanf family), privilege management ordering, ReDoS, and dozens of other memory-safety and secure-coding checks. Rules are published to the Semgrep registry as "p/0xdea" and can be run directly via `semgrep --config "p/0xdea"` or cloned locally, with SARIF output support for triage in VS Code via SARIF Explorer. The repo also documents a roadmap including porting rules to the Semgrep Pro engine for taint/inter-procedural analysis.

github.comrepoAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

depthfirst's Open Defense Initiative scanned about 40 Ruby gems with native C extensions and validated 105 vulnerabilities across 34 projects, which together have over 8.6 billion RubyGems downloads. The post walks through four cases: a Nokogiri 32/64-bit index truncation (CVE-2026-57235), an Oj garbage-collection use-after-free (CVE-2026-54902), a concurrent-ruby read/write lock bit overflow (CVE-2026-54905) and an sqlite3-ruby block lifetime bug (CVE-2026-54619). It also states that this work led to the earlier GitLab RCE chain through Oj.

depthfirst.comwriteupAdded 29 Oct 2026, published 27 Jul 2026🛡️ Security

Covers CVE-2026-42533, a heap buffer overflow (CWE-122) in the NGINX map directive's regex handling. It is triggered when a string expression references unnamed captures before the map output variable. Unauthenticated crafted HTTP requests can crash workers and may give RCE where ASLR is off or bypassed. It also covers two other F5-patched NGINX flaws: CVE-2026-60005 (uninitialized memory disclosure in ngx_http_slice_module) and CVE-2026-56434 (use-after-free in ngx_http_ssi_module with proxy_pass and proxy_buffering off). It lists affected NGINX Open Source (0.9.6–1.31.2), NGINX Plus, Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager versions. It gives fixed releases (1.31.3 / 1.30.4) and the named-capture workaround, and notes no public PoC or in-the-wild exploitation.

orca.securityadvisoryPublished and added 20 Jul 2026🛡️ Security

LucidBit Labs details CVE-2026-20971, a use-after-free race condition in Samsung's PROCA/FIVE kernel integrity subsystem, exploitable via procfs handlers (/proc/pid/integrity/*) that fetch task_integrity pointers without taking a reference before an execve() concurrently frees the old object. The bug affects Galaxy S9 through S25 and other Samsung devices on both Qualcomm and Exynos chipsets, is triggerable from any untrusted app, and yields memory corruption primitives (though not a full LPE exploit); Samsung patched it in the 01-2026 update.

lucidbitlabs.comwriteupAdded 3 Sep 2026, published 18 Jul 2026🛡️ Security

XBOW's detailed technical writeup on CVE-2026-45185, a critical unauthenticated remote-code-execution vulnerability in Exim triggered by a use-after-free during GnuTLS TLS shutdown: Exim frees its xfer_buffer while a nested BDAT chunking receive wrapper can still call the stale tls_ungetc(), writing a single newline byte into freed memory that lands on allocator metadata and escalates to RCE. The post walks through Exim's SMTP/BDAT/TLS receive-callback plumbing and its custom store pool allocator in detail, then narrates a seven-day disclosure-window contest where the researcher (assisted by an LLM) and XBOW's autonomous exploit-development harness raced to build a working exploit chain (glibc largebin corruption, hijacking a malloc call via Exim's spool fdopen, and overwriting a FILE struct) against progressively hardened builds.

xbow.comwriteupPublished and added 13 May 2026🛡️ Security