CVE-2026-74937
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunder
CVSS
8.8
Alto
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Publicado: 18 ago 2026 · Última mod.: 19 ago 2026 · CWE-416
0.3%EPSS · 30 días0.3%
2026-08-192026-09-06
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2053337
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-74/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-77/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-78/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-80/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-864253.3 BAJ—
———ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).22hCVE-2026-864233.3 BAJ—
———ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).22hCVE-2026-82325——
——0A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages1dCVE-2026-205176.7 MED—
——0In geniezone, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900510; Issue ID: MSV-6781.7hCVE-2026-205155.5 MED—
——0In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132.1dCVE-2026-205116.7 MED—
——0In SurfaceFlinger, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11123860; Issue ID: MSV-8890.7h