Unity Linux 20.1070e Security Update: SDL2 (UTSA-2026-017800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017800 advisory. SDL Simple DirectMedia Layer through 2.0.12 has an Integer Overflow and resultant SDLmemcpy heap corruption in SDLBlitCopy in video/SDLblitcopy.c via a crafted .BMP...

CVE-2026-44117 OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests...

CVE-2026-27950 FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been...

CVE-2026-24680 FreeRDP has a heap-use-after-free in update_pointer_new(SDL)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdlPointerNew frees data on failure, then pointerfree calls sdlPointerFree and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0...

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

EUVD-2025-205366

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service...

CVE-2025-66443

CVE-2025-66443 affects Pexip Infinity 35.0–38.1 (before 39.0) in non-default configurations that use Direct Media for WebRTC. The issue is improper input validation in the signaling path, allowing an attacker to trigger a software abort and cause a temporary denial of service. Red Hat and other s...

PT-2025-53395

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions 35.0 through 38.1 Description Pexip Infinity, in non-default configurations utilizing Direct Media for WebRTC, exhibits an improper input validation issue within its signalling process. This flaw allows an attacker to...

OPENSUSE-SU-2025:15205-1 SDL-1.2.15-1.1 on GA media

These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the XFree function in the /src/video/x11/SDL_x11yuv.c file of the Simple DirectMediaLayer library allows a hacker to cause a service failure.

The vulnerability of the XFree function in the /src/video/x11/SDLx11yuv.c file of the Simple DirectMediaLayer library is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SUSE CVE-2019-7573

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMSADPCM in audio/SDLwave.c inside the wNumCoef loop...

USN-5398-1 libsdl1.2, libsdl2 vulnerability

It was discovered that SDL Simple DirectMedia Layer incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code...

SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMAADPCMdecode in audio/SDLwave.c...

SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMSADPCM in audio/SDLwave.c inside the wNumCoef loop...

UBUNTU-CVE-2019-13626

SDL Simple DirectMedia Layer 2.x through 2.0.9 has a heap-based buffer over-read in FillIMAADPCMblock, caused by an integer overflow in IMAADPCMdecode in audio/SDLwave.c...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is an out-of-bounds read in the SDL function SDLFreePaletteREAL at...