CVE-2026-121961

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...

CVE-2026-121963

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback threa...

CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121957

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more t...

CVE-2026-121953

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfxonclose frees without clearing. A malicious RDP server can open and close such a channel, then send ...

CVE-2026-121963

FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free flaw within the asynchronous dynamic rdpsnd channel. The root cause occurs when a malicious RDP server sends a training PDU and subsequently closes the channel with queued audio PDUs, causing the playback thread to read a freed c...

CVE-2026-121961

FreeRDP versions before 3.32.2 are vulnerable to a use-after-free condition in the freerdp-proxy DRDYNVC tracker during drdynvc channel interception. The root cause is a race condition where a malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel ID, racing the fron...

CVE-2026-121957

FreeRDP before version 3.32.2 is vulnerable to a use-after-free condition caused by a race condition in the RDPGFX ResetGraphics handler. A malicious RDP server can trigger this by concurrently sending ResetGraphics commands and compressed bitmaps of 32 bpp or more , leading to heap use-after-fre...

CVE-2026-121955

FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free vulnerability within the Emulate_SCardReleaseContext function. The root cause is that the emulated SCardContext is freed before its associated worker thread is cancelled and joined. A malicious server can trigger this by sending ...

CVE-2026-121953

FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free flaw within the client's rdpgfx dynamic virtual channel . The root cause occurs when a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot; subsequently, the rdpgfx_on_close function frees t...

vvdecapp reconstructCoeff Memory Use After Free

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

vvdecapp reconstructCoeff Memory Use After Free

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

vvdecapp reconstructCoeff Memory Use After Free

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

vvdecapp Decoder Heap Buffer Overflow DoS

The vulnerability of the createSubPicRefBufs function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

vvdecapp readAlf Heap Buffer Overflow DoS

The vulnerability of the readAlf function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

vvdecapp decoder reconstructCoeff Heap Buffer Overflow DoS

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after deallocation when processing specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

1C-Bitrix Before and After Photos Code Execution

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

Microsoft Office Memory Use After Free

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Exploit for Use After Free in Linux Linux_Kernel

ghostlock-pd2118c-4.19.152 A full field report of CVE-2026-...

m4ngl3m3

m4ngl3m3! Quick Installation: $ git clone https://github.com/localh0t/m4ngl3m3 $ cd m4ngl3m3 $ ./main.py Basic Help: usage: main.py -h -fy FROMYEAR -ty TOYEAR -sy -nf NUMBERSFILE -sf SYMBOLSFILE -cf CUSTOMFILE -sbs -sap -mm MUTATIONMETHODS MUTATIONMODE STRINGSFILE OUTPUTFILE Common password patte...