19 matches found
CVE-2026-121403
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting...
CVE-2026-121403 FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting...
CVE-2026-121403
FreeRDP versions before 3.32.2 are vulnerable to a denial of service (DoS) condition. The root cause is a malformed drive DEVICE_IOREQUEST featuring a truncated IRP_MJ_CREATE body, which silently terminates the drive worker. A malicious RDP server can exploit this by sending the malformed IRP and...
EUVD-2026-115935
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting...
UBUNTU-CVE-2026-110830
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...
CVE-2026-110830
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...
CVE-2026-110831 FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in driveprocessirpcreate, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...
CVE-2026-110831
FreeRDP versions 3.13.0 before 3.32.0 are vulnerable to a resource leak within the drive_process_irp_create function. The flaw occurs because the software registers an opened local file in the drive dictionary before verifying the allocation size and fails to remove it if the operation fails. A m...
CVE-2026-110831 FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in driveprocessirpcreate, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...
CVE-2026-110831 FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in driveprocessirpcreate, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...
CVE-2026-110830
FreeRDP versions before 3.32.0 are vulnerable to a Denial of Service (DoS) condition. The root cause is located in the serial_process_irp_create function, which fails to close prior serial handles. This allows a malicious RDP server to send repeated serial IRP_MJ_CREATE requests, leading to file ...
CVE-2026-110830 FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...
CVE-2026-110830 FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...
CVE-2026-79417
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...
CVE-2026-79417
A local improper access control vulnerability exists in ArgusMonitor.sys within Argotronic eGbR ArgusMonitor versions 7.4.02 and earlier . A Time-of-Check to Time-of-Use (TOCTOU) condition in IRP_MJ_CREATE allows local, low-privileged users to bypass device handle access restrictions. By sending ...
EUVD-2026-89424
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...
CVE-2026-79417: Improper Access Control
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...
CVE-2026-79417
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...
CVE-2026-82964
Improper preservation of permissions in the Avast sandbox minifilter driver aswSnx.sys on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, b...