Proxygen QuicWtSession Use-After-Free in closeSession

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Facebook, Inc.

Description

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-84895

Affected Vendors & Products

Vendor	Product	Version / Range
facebook	proxygen	From 2026.04.06.00 (inc) to 2026.09.28.00 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

In proxygen versions between v2026.04.06.00 and v2026.09.28.00, a use-after-free vulnerability exists in the QuicWtSession::closeSession method. After calling the base class method QuicWtSessionBase::closeSession, the derived class continues to access its member fields. The base method notifies the session handler, which may release the last reference to the session and destroy it, leading to potential memory corruption or crashes.

Impact Analysis

This vulnerability could cause application crashes, data corruption, or unexpected behavior in systems using affected proxygen versions. Attackers might exploit it to execute arbitrary code, escalate privileges, or perform denial-of-service attacks on services relying on proxygen for QUIC/WireTransport functionality.

Mitigation Strategies

Update proxygen to a version beyond v2026.09.28.00 to resolve the issue where QuicWtSession::closeSession accesses member fields after destruction.

Hi! I’m here to help you understand CVE-2026-84895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70