{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84894", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-09-02T14:52:36.354Z", "datePublished": "2026-09-28T18:40:55.707Z", "dateUpdated": "2026-09-28T18:40:55.707Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "moxygen", "vendor": "Meta Platforms, Inc", "versions": [{"lessThan": "004123dd24c30dad6b649163575145f240dabc94", "status": "affected", "version": "b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9", "versionType": "git"}]}], "dateAssigned": "2026-09-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write."}], "problemTypes": [{"descriptions": [{"description": "Use After Free (CWE-416)", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-09-28T18:40:55.707Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2026-84894"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "moxygen", "vendor": "Meta Platforms, Inc", "versions": [{"lessThan": "004123dd24c30dad6b649163575145f240dabc94", "status": "affected", "version": "b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9", "versionType": "git"}]}], "source": "cve-assign@fb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write."}], "id": "CVE-2026-84894", "lastModified": "2026-09-28T19:16:50.213", "metrics": {}, "published": "2026-09-28T19:16:50.213", "references": [{"source": "cve-assign@fb.com", "url": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94"}, {"source": "cve-assign@fb.com", "url": "https://www.facebook.com/security/advisories/cve-2026-84894"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Received"}

{}

{}