CVE Watch16 oct 2026

CVE-2026-94453

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa

CVSS

7.5

Alto

EPSS

0.5%

p38

KEV

—

Exploit Today

0-100

Publicado: 13 oct 2026 · Última mod.: 16 oct 2026 · CWE-416

EPSS · 30d

0.5%EPSS · 30 días0.5%

2026-10-142026-10-20

Descripción técnica

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-972067.5 ALT

—

——0NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.22h CVE-2026-114111—

—

——0sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.1d CVE-2026-1140426.5 MED

—

——0FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.1d CVE-2026-1133448.8 ALT

—

——0Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)1d CVE-2026-1133398.8 ALT

—

——0Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)1d CVE-2026-1133388.8 ALT

—

——0Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)1d