In the Facebook Proxygen library, the QuicWtSession::closeSession function accesses its own member fields after invoking the base class QuicWtSessionBase::closeSession. The base implementation notifies the session handler, which can release the last reference to the session and deallocate it, leaving the derived method with dangling pointers. This timing flaw creates a use‑after‑free condition that an attacker may exploit to corrupt memory, cause a crash, or potentially execute arbitrary code if additional conditions are met.

Versions of Proxygen released from v2026.04.06.00 up to and including v2026.09.28.00 are affected. The issue is limited to the internal QUIC session handling code in the proxygen component provided by Facebook.

The CVSS score of 7.3 indicates moderate‑to‑high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. However, the nature of the flaw—a use‑after‑free that occurs during session teardown—represents a high potential severity, especially in scenarios where external clients initiate QUIC connections to a server that uses Proxygen. Because the flaw allows a reference release that can free the object before the derived method finishes accessing it, the vulnerability is amenable to exploitation with the proper coordination and could lead to memory corruption or execution of injected code. The vulnerability is not listed in the CISA KEV catalog at this time.