CVE Watch10 sept 2026

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyr

CVSS

4.2

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 9 sept 2026 · Última mod.: 10 sept 2026 · CWE-415

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-875858.8 ALT

9.7%

——3Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)1d CVE-2026-799077.8 ALT

8.8%

——3Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.17h CVE-2026-819507.8 ALT

36.7%

——11Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.2d CVE-2026-800808.8 ALT

47.0%

——14Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.2d CVE-2026-775048.8 ALT

47.6%

——14Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.2d CVE-2026-774939.8 CRÍ

60.0%

——18Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.14h