CVE-2026-84895: Use After Free
Published Sep 28, 2026
·Updated
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
Affected Software
1 affected component
Meta Proxygen>=2026.04.06.00<2026.09.28.00
Event History
Sep 28, 2026
CVE Published
via MITRE·08:44 PM
Data Sourced
via MITRE·08:44 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
Description
Frequently Asked Questions
1
How can I determine whether a deployment is in the affected range?
Check the Proxygen version in use. The reported affected range is from v2026.04.06.00 until v2026.09.28.00.
2
What runtime condition is required for the unsafe access to occur?
During session closure, the session handler must be able to release the last reference to the session when it is notified by the base closeSession method. The derived closeSession method then accesses member fields after that notification, when the session may already have been destroyed.