CyberRota Analysis
AI-GeneratedThe vulnerability affects the proxygen library, specifically in the WebTransportImpl component, where read callbacks for closed streams are not properly unregistered before destruction. This flaw could lead to the invocation of freed memory, potentially resulting in application crashes or arbitrary code execution. Organizations utilizing proxygen versions from v2024.10.28.00 to v2026.09.28.00 should prioritize patching this issue to mitigate associated risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.