In proxygen versions v2024.10.28.00 through v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and onWebTransportBidiStream handlers can return already freed stream handles. The session installs these freed handles as transport read callbacks, which may lead to a use‑after‑free condition. This can corrupt memory, crash the process, or in a malicious context be exploited for arbitrary code execution. The flaw corresponds to a use‑after‑free weakness (CWE‑416).

Affected systems are deployments of Facebook’s proxygen library within the version range v2024.10.28.00 to v2026.09.28.00. Any service that incorporates these library versions and utilizes WebTransport stream APIs may be vulnerable, including reverse proxies, load balancers, or application servers using proxygen.

The vulnerability has an EPSS score of less than 1%, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog, so no known exploits are reported. The CVSS score of 5.3 indicates moderate severity and suggests potential for memory corruption that may lead to crashes or, in privileged contexts, code execution. Use‑after‑free bugs can pose a significant risk to application stability and can be triggered remotely through crafted WebTransport traffic. The attack vector likely involves an adversary capable of sending malicious HTTP/2 or HTTP/3 requests that invoke the vulnerable APIs, potentially leading to denial of service or code execution if the target process is running as a privileged user. Given the absence of current exploit evidence, the risk is moderate to high for exposed services, but exploitation likelihood remains uncertain without evidence of active attacks.