CVE-2025-36940

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-36968.8A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affeCVE-2025-36978.8A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This iCVE-2025-36987.5Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-36999.8Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A CVE-2025-37014.3Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly ConfiguCVE-2025-37025.4Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly ConfigureCVE-2025-37037.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & CVE-2025-37045.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up SheCVE-2025-37056.8A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used CVE-2025-37066.1The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbiCVE-2025-37076.5The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commaCVE-2025-37089.8Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to injec
CVE-2025-36940: High severity, CVSS 8.8 | Vulnix