CVE-2026-121951

A flaw was found in FreeRDP. In server-side input parsing, the application skips the body of an unknown input event without verifying that the data remains within the declared packet length. A remote attacker with an active session can send a crafted, truncated input event, triggering an internal...

CVE-2026-121951

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

SUSE CVE-2026-121394

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfxrlgrdecode and...

SUSE CVE-2026-121395

FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process...

CVE-2026-121951

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

DEBIAN-CVE-2026-121951

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

bind: bind: Denial of service via assertion failure in RPZ query processing

A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...

bind: bind: Denial of Service via assertion failure during redirect processing

A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...

bind: bind: Denial of Service via assertion failure during redirect processing

A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...

bind: bind: Denial of service via assertion failure in RPZ query processing

A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...

CVE-2026-121951 FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

CVE-2026-121951 FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

CVE-2026-121951 FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

CVE-2026-121951

FreeRDP versions 3.0.0 before 3.32.2 are vulnerable to a Denial of Service via a slow-path input event. The issue exists in the server-side RDP peer input parsing, where the system skips the six-byte body of an unknown message type without verifying that it lies within the packet's declared lengt...

EUVD-2026-116951

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

CVE-2026-121394

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfxrlgrdecode and...

OESA-2026-4665 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: In a BIN...

OESA-2026-4664 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: In a BIN...

bind: bind: Denial of service via assertion failure in RPZ query processing

A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...

bind: bind: Denial of Service via assertion failure during redirect processing

A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...