CVE-2023-25136
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The d
CVSS
6.5
Medium
EPSS
89.8%
p100
KEV
—
Exploit Today
30
0-100
Published: Feb 3, 2023 · Last modified: Oct 14, 2026 · CWE-415
89.7%EPSS · 30 days89.8%
2026-09-222026-10-19
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/13/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/22/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/22/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/23/3
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/03/06/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/03/09/2
- bugzilla.mindrot.orghttps://bugzilla.mindrot.org/show_bug.cgi?id=3522
- ftp.openbsd.orghttps://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig
- github.comhttps://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946
- jfrog.comhttps://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- news.ycombinator.comhttps://news.ycombinator.com/item?id=34711565
- security.gentoo.orghttps://security.gentoo.org/glsa/202307-01
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230309-0003/
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2023/02/02/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/13/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/22/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/22/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/23/3
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-869625.5 MED—
——0A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.10hCVE-2026-1120364.3 MED25.7%
——8A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.1dCVE-2026-574465.3 MED32.9%
——10libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.4dCVE-2026-1105997.1 HIG14.6%
——4L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.5dCVE-2026-94370—25.0%
——7A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.5dCVE-2026-956357.8 HIG12.1%
——4Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6d