The flaw in Proxygen causes a use‑after‑free condition when SessionStreams are terminated; read callbacks that were no longer valid are still registered and can be invoked after the memory holding them is freed. An attacker that can trigger a read on a torn session could therefore execute code through the freed callback or cause a crash, resulting in data loss or service disruption.

Facebook Proxygen library versions from v2024.10.28.00 up to and including v2026.09.28.00 contain the vulnerability; older releases before v2025.08.18.00 feature a similar bug in WebTransportImpl::destroy.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need access to a service exposing WebTransport to trigger the flaw. The likely attack vector is sending crafted traffic that causes the WebTransportImpl to invoke a read callback on freed memory. The attacker’s ability to influence the freed memory region could result in a crash or potential code execution, but the risk remains high until the patch is applied.