cve.bz

CWE-415: Double Free, page 3

Filter

The product calls free() twice on the same memory address.

What the weakness is: CWE-415 at MITRE

Ask an AI about CWE-415

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-415: Double Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/415.html and https://cve.bz/cve/cwe/415?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2026-65780EPSS 0.3%

    Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

  2. 8.1CVE-2026-62889EPSS 0.7%

    Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

  3. 7.0CVE-2026-62766EPSS 0.3%

    Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

  4. 7.0CVE-2026-61366EPSS 0.3%

    Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

  5. 5.9CVE-2026-11894EPSS 0.2%

    The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract requires the driver to consume (unref) the transmit net_buf…

  6. 5.9CVE-2026-11893EPSS 0.2%

    The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at includ…

  7. 7.8CVE-2026-68236EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the p…

  8. 8.8CVE-2026-68192EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent…

  9. 7.5CVE-2026-20338EPSS 0.6%

    A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip fil…

  10. 8.5CVE-2026-43622EPSS 0.2%

    llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap met…

  11. 7.8CVE-2026-64599EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in meson_crypto_probe() When meson_allocate_chanlist() fails after a partial allocation, it already unwinds the allocated chanlist…

  12. 9.8CVE-2026-64597EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails bef…

  13. 7.8CVE-2026-64580EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device …

  14. 7.8CVE-2026-64570EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. I…

  15. 8.7CVE-2026-55995EPSS 0.3%

    A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

  16. 4.0CVE-2026-17573EPSS 0.2%

    A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

  17. 9.8CVE-2026-64535EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatc…

  18. 7.8CVE-2026-64447EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_ini…

  19. 9.8CVE-2026-64387EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init()…

  20. 9.8CVE-2026-64386EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails b…

  21. 9.8CVE-2026-64385EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails bef…

  22. 9.8CVE-2026-64384EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails befo…

  23. 9.8CVE-2026-64383EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received…

  24. 8.8CVE-2026-64382EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails befor…

  25. 7.8CVE-2026-64377EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init…

  26. 7.5CVE-2026-66373EPSS 0.9%

    Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting b…

  27. 8.7CVE-2026-66032EPSS 0.4%

    libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. Whe…

  28. 7.8CVE-2026-64242EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The …

  29. 7.8CVE-2026-64224EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvu_rep_rsrc_init() rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). When hardware resource setup fai…

  30. 7.0CVE-2026-64222EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the point…

  31. 7.5CVE-2026-43823EPSS 0.4%

    When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when …

  32. 8.7CVE-2026-64832EPSS 0.3%

    FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surf…

  33. 9.3CVE-2026-64621EPSS 0.4%

    FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorId…

  34. 8.4CVE-2026-64118EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt_tables_alloc() If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previou…

  35. 7.8CVE-2026-64054EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf …

  36. 7.8CVE-2026-63907EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev…

  37. 9.8CVE-2026-63888EPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integrat…

  38. 6.2CVE-2026-13713EPSS 0.2%

    YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and …

  39. 7.8CVE-2026-55132EPSS 0.6%

    Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  40. 7.5CVE-2026-50685EPSS 0.7%

    Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.

  41. 7.8CVE-2026-50361EPSS 0.3%

    Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-55004EPSS 0.3%

    Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

  43. 8.7CVE-2026-12659EPSS 0.4%

    A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the…

  44. 1.9CVE-2025-15667EPSS 0.2%

    A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes doub…

  45. 2.1CVE-2026-14604EPSS 0.2%

    A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation cause…

  46. 9.8CVE-2026-8925EPSS 1.1%

    The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

  47. 7.3CVE-2026-58381EPSS 0.3%

    A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading…

  48. 8.1CVE-2026-10653EPSS 0.4%

    The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (bu…

  49. 7.5CVE-2026-14164EPSS 0.8%

    A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent proces…

  50. 6.5CVE-2026-43706EPSS 0.4%

    A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing malic…