CVE-2026-84895

Deferred Deferred - Pending Action

Proxygen QuicWtSession Use-After-Free in closeSession

Publication date: 2026-09-28

Last updated on: 2026-10-01

Assigner: Facebook, Inc.

Description

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84895

Affected Vendors & Products

Vendor	Product	Version / Range
facebook	proxygen	From 2026.04.06.00 (inc) to 2026.09.28.00 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

In proxygen versions between v2026.04.06.00 and v2026.09.28.00, a use-after-free vulnerability exists in the QuicWtSession::closeSession method. After calling the base class method QuicWtSessionBase::closeSession, the derived class continues to access its member fields. The base method notifies the session handler, which may release the last reference to the session and destroy it, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability involves a use-after-free condition in proxygen's QuicWtSession::closeSession method. Detection requires analyzing application logs for crashes or memory access violations during session closure. Monitor for abnormal termination of proxygen processes or core dumps. Check for error messages indicating invalid memory access in proxygen logs.

Impact Analysis

This vulnerability could cause application crashes, data corruption, or unexpected behavior in systems using affected proxygen versions. Attackers might exploit it to execute arbitrary code, escalate privileges, or perform denial-of-service attacks on services relying on proxygen for QUIC/WireTransport functionality.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The issue involves a use-after-free scenario in QuicWtSession::closeSession, which could lead to memory corruption or crashes but lacks details on regulatory implications.

Mitigation Strategies

Update proxygen to a version beyond v2026.09.28.00 to resolve the issue where QuicWtSession::closeSession accesses member fields after destruction.

Hi! I’m here to help you understand CVE-2026-84895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70