Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-06-23 | 1 | Disclosure1 |
| 2026-07-05 | 1 | Patch1 |
Difyでテナント跨ぎでデータが漏洩する脆弱性群DifyTapについて。CVE-2024-5846、CVE-2026-41947、CVE-2026-41948、CVE-2026-41949、CVE-2026-41950。CVE-2026-41948は未修正。それ以外はバージョン1.14.2で修正。 https://thehackernews.com/2026/06/researchers-detail-difytap-flaws-in.html?m=1
Post summary
Researchers announced a set of DifyTap vulnerabilities that allow tenant‑cross data leakage, noting that most have been patched in v1.14.2 except CVE‑2026‑41948.
Update: Dify addressed all four DifyTap vulnerabilities in version 1.14.2, with the PDFium library (CVE-2024-5846) separately updated in December 2025—meaning the use-after-free flaw had been shipped for approximately 18 months before remediation. https://ift.tt/i2udGRs
Post summary
Dify released version 1.14.2 and an updated PDFium library to fix all DifyTap vulnerabilities, including CVE‑2024‑5846—a use‑after‑free flaw that had existed for roughly 18 months before remediation.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fedoraproject | fedora | 39 | - | - |
| OS | fedoraproject | fedora | 40 | - | - |
| App | chrome | - | - | - |