Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79039] Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker…

Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79027] Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execut…

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-78990] Use after free in Compositing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to e…

Use after free in Compositing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-78983] Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had co…

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

25/08/2026

[CVE-2026-78944] Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leverag…

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

25/08/2026

[CVE-2026-78913] Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to po…

Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

25/08/2026

[CVE-2026-78899] Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59184] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application wr…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2025-71406] Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two u…

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upg…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2025-36940] Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privile…

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78376] A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due…

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-77235] Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.…

Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to version 11.3.1 or later.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-39909] llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE h…

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-18299] GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows …

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16851] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a use-after-free.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad alta en kernel: corrupción de memoria en operaciones de fork (CVE-2026-58083)

Una vulnerabilidad de race condition en el kernel permite que knotes con filtros basados en timer se colen en la lista activa de kqueue durante operaciones de fork, corrompiendo estructuras de memoria altas. Con CVSS 8.4, afecta la estabilidad y seguridad de servidores Unix/BSD en entornos empresariales de LATAM. La falta de sincronización de locks durante la copia de knotes habilita explotación local con privilegios elevados.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-49422] The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace…

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to fr…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-63639] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-56684] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-74949] Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability w…

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.

nvdaltovulnerabilidad CVSS 8.8 NVD