7042 matches found
CVE-2026-109242
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
CVE-2026-109242
FreeRDP versions prior to 3.0.0 and 3.6.0 (before 3.32.0 ) are vulnerable to an uninitialized heap disclosure via a progressive codec tile upgrade. The root cause is that the tile->current buffer is allocated without being zeroed out. A malicious RDP server can exploit this by sending a crafte...
EUVD-2026-97686
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
CVE-2026-109242 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
CVE-2026-109242 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
CVE-2026-109243 FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...
CVE-2026-109243 FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...
CVE-2026-109243
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...
EUVD-2026-97687
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...
CVE-2026-109243
The FreeRDP application, versions 3.0.0 through 3.31.x , is vulnerable to an incorrect permission assignment (CWE-732) in the soft-smartcard component. Specifically, the crypto_write_pem function fails to apply owner-only permissions to private keys. On multi-user Unix hosts, local attackers can ...
CVE-2026-109240
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...
CVE-2026-109241
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send VideoData that...
CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...
EUVD-2026-97685
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send VideoData that...
CVE-2026-109241
FreeRDP versions before 3.32.0 are vulnerable to a NULL pointer dereference in the client video redirection channel. A malicious server can trigger a denial of service (DoS) by sending out-of-order messages, specifically a Geometry CLEAR message to null presentation->geometry followed by Video...
CVE-2026-109240
FreeRDP versions 3.11.0 before 3.32.1 are vulnerable to a reachable assertion vulnerability within the urb_isoch_transfer function. A malicious RDP server can cause a client to crash by sending a TS_URB_ISOCH_TRANSFER IN-direction request over URBDRC containing an unvalidated OutputBufferSize val...
CVE-2026-109241
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send VideoData that...
EUVD-2026-97684
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...
CVE-2026-109241 FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send VideoData that...
CVE-2026-109241 FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send VideoData that...