CVE-2026-84895

EUVD-2026-88543
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
MetaCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 9.29%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
facebookproxygen
2026.4.6.0 ≤
𝑥
< 2026.9.28.0
CNA
Common Weakness Enumeration
References
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
https://www.facebook.com/security/advisories/cve-2026-84895