CVE-2026-113970
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and
CVSS
8.8
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 nov 2026 · Última mod.: 10 nov 2026 · CWE-416
Sin historial EPSS suficiente todavía.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory.
- support.apple.comhttps://support.apple.com/en-us/149715
- support.apple.comhttps://support.apple.com/en-us/149716
- support.apple.comhttps://support.apple.com/en-us/149717
- support.apple.comhttps://support.apple.com/en-us/149718
- support.apple.comhttps://support.apple.com/en-us/149719
- support.apple.comhttps://support.apple.com/en-us/149720
- support.apple.comhttps://support.apple.com/en-us/149722
- support.apple.comhttps://support.apple.com/en-us/149723
- support.apple.comhttps://support.apple.com/en-us/149724
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1254008.8 ALT—
———Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.12hCVE-2026-1253945.4 MED—
———FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.12hCVE-2026-1252655.3 MED—
——0FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.16hCVE-2026-1252555.3 MED—
——0FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.16hCVE-2026-1246845.1 MED—
——0Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5.1dCVE-2026-1243085.8 MED1.3%
——0Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.22h