PULSE
FEED
ransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Servicesransomglobal secret group reclama a TDS Telecommunications LLC. · US · Energy & Utilitiesransomshiba reclama a IT Foods Industries · Agriculture and Food Productionransomshiba reclama a Friendly Senior Living · Healthcareransomshiba reclama a Morgan White Group · Professional Servicesransomshiba reclama a Antwerp House Dentistry · GB · Healthcareransomeverstake reclama a as*****g.comransomeverstake reclama a ca*****s.comransomeverstake reclama a in*****s.comransomeverstake reclama a corp-smart.com · Technologyransomwhitearmor reclama a rolly.io · Technologyransomemperador reclama a LA PROFUMERIA SRL · IT · Retail & E-Commerceransomscarlettgroup reclama a sunnybrook.ca · CA · Healthcareransomscarlettgroup reclama a au.bank.in · IN · Financial Servicesransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Servicesransomglobal secret group reclama a TDS Telecommunications LLC. · US · Energy & Utilitiesransomshiba reclama a IT Foods Industries · Agriculture and Food Productionransomshiba reclama a Friendly Senior Living · Healthcareransomshiba reclama a Morgan White Group · Professional Servicesransomshiba reclama a Antwerp House Dentistry · GB · Healthcareransomeverstake reclama a as*****g.comransomeverstake reclama a ca*****s.comransomeverstake reclama a in*****s.comransomeverstake reclama a corp-smart.com · Technologyransomwhitearmor reclama a rolly.io · Technologyransomemperador reclama a LA PROFUMERIA SRL · IT · Retail & E-Commerceransomscarlettgroup reclama a sunnybrook.ca · CA · Healthcareransomscarlettgroup reclama a au.bank.in · IN · Financial Services
← All CVEs
CVE WatchOct 30, 2026

CVE-2026-65586

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with anoth

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-416

EPSS · 30d

Not enough EPSS history yet.

Technical description

Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-15466—
—
———Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.6h
CVE-2026-76031—
—
———Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7h
CVE-2026-76028—
—
———Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7h
CVE-2026-76025—
—
———Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7h
CVE-2026-119271—
—
———Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7h
CVE-2026-119269—
—
———Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7h