CVE-2026-109676
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed
CVSS
8.8
Alto
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Publicado: 13 oct 2026 · Última mod.: 14 oct 2026 · CWE-416
0.3%EPSS · 30 días0.3%
2026-10-142026-10-22
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1118048.2 ALT12.9%
——4Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.2dCVE-2026-1096199.8 CRÍ93.0%
——28PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).1dCVE-2026-1096189.8 CRÍ92.6%
——28PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).1dCVE-2026-972067.5 ALT17.1%
——5NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.22hCVE-2026-114111—2.3%
——1sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.3dCVE-2026-1140426.5 MED16.0%
——5FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.22h