CVE-2022-23308
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVSS
7.5
High
EPSS
5.1%
p92
KEV
—
Exploit Today
28
0-100
Published: Feb 26, 2022 · Last modified: Oct 14, 2026 · CWE-416
5.1%EPSS · 30 days5.1%
2026-10-072026-11-04
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/33
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/34
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/35
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/36
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/37
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/38
- github.comhttps://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
- gitlab.gnome.orghttps://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/
- security.gentoo.orghttps://security.gentoo.org/glsa/202210-03
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220331-0008/
- support.apple.comhttps://support.apple.com/kb/HT213253
- support.apple.comhttps://support.apple.com/kb/HT213254
- support.apple.comhttps://support.apple.com/kb/HT213255
- support.apple.comhttps://support.apple.com/kb/HT213256
- support.apple.comhttps://support.apple.com/kb/HT213257
- support.apple.comhttps://support.apple.com/kb/HT213258
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/33
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-69044——
——0In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.9hCVE-2026-69043——
——0In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption9hCVE-2026-824189.8 CRI—
——0IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.15hCVE-2026-1219557.5 HIG—
——0FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.17hCVE-2026-1219539.8 CRI—
——0FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.17hCVE-2026-104608—34.5%
——10A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.2d