Skip to content
Log inStart free trial

GHSA-gvqv-779r-4jgp GHSA-gvqv-779r-4jgp

Use after free in CefSharp

Critical Known exploited NuGet
Severity
9.6 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
2.73%
Chance of exploitation in the next 30 days. Higher than 86.08% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog
Weakness
CWE-416 Use After Free
Fix
Available
4 packages have a fixed version

Description

CVE-2020-16017: Use after free in site isolation

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as High severity.

Affected versions

NuGet

PackageVulnerableFixed in
CefSharp.Common
< 86.0.241
86.0.241
CefSharp.WinForms
< 86.0.241
86.0.241
CefSharp.Wpf
< 86.0.241
86.0.241
CefSharp.Wpf.HwndHost
< 86.0.241
86.0.241

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

CefSharp.Common NuGet → 86.0.241

dotnet
dotnet add package CefSharp.Common --version 86.0.241

CefSharp.WinForms NuGet → 86.0.241

dotnet
dotnet add package CefSharp.WinForms --version 86.0.241

CefSharp.Wpf NuGet → 86.0.241

dotnet
dotnet add package CefSharp.Wpf --version 86.0.241

CefSharp.Wpf.HwndHost NuGet → 86.0.241

dotnet
dotnet add package CefSharp.Wpf.HwndHost --version 86.0.241

Severity breakdown

CVSS 3.1 9.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it
  • Architecture and Design: Choose a language that provides automatic memory management.
  • Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

References

Advisories

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-vv6j-ww6x-54gx
Use after free in Animation
High Known exploited Also affects CefSharp.Common
CVE-2020-16013
Inappropriate implementation in V8 in CefSharp
High Known exploited Also affects CefSharp.Common
CVE-2020-16009
Inappropriate implementation in V8
High Known exploited Also affects CefSharp.Common
CVE-2020-15999
Heap buffer overflow in CefSharp
Critical Known exploited Also affects CefSharp.Common
CVE-2026-109619
PHP has various global state that temporarily points into request memory.
Critical Known exploited Same weakness, CWE-416
CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
Critical Known exploited Same weakness, CWE-416
GHSA-7mwm-ghpf-9vrm
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
High Same weakness, CWE-416
GHSA-4rr5-89j8-mwwm
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
High Same weakness, CWE-416
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor