CVE-2025-29895

A NULL pointer dereference vulnerability exists in Qsync Central , specifically affecting the qsyncsrv.cgi component. A remote attacker who has obtained a valid user account can exploit this flaw to trigger a denial-of-service (DoS) attack. The vulnerability has been addressed in Qsync Central ve...

EUVD-2026-101870

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional...

CVE-2026-101302

The FreeBSD kernel's KTLS (Kernel TLS) module is vulnerable to a Remote Denial of Service (DoS) due to an off-by-one bug in the code that searches for the inner record type in TLS 1.3 decrypted payloads. A remote peer can trigger an underflow followed by an unconditional NULL pointer dereference ...

CVE-2026-110834

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending read or write requests for a redirected serial device before the device is opened or after it has been closed. Because FreeRDP does not verify that the serial communication...

CVE-2026-110829

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a malformed audio channel rdpsnd fragment to a connecting client. Due to missing validation of packet flags, processing a terminating fragment on an uninitialized channel...

EUVD-2026-101712

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

EUVD-2026-101717

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

PT-2026-115134

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

PT-2026-115135

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

Linux Distros Unpatched Vulnerability : CVE-2026-110834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycl...

Linux Distros Unpatched Vulnerability : CVE-2026-110829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST...

CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

DEBIAN-CVE-2026-110834

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

CVE-2026-110834

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

DEBIAN-CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

CVE-2026-110834 FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

CVE-2026-110834

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

CVE-2026-110834

FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a null pointer dereference when using Linux serial redirection . A malicious RDP server can trigger a Denial of Service by sending out-of-lifecycle serial IRPs (specifically IRP_MJ_READ or IRP_MJ_WRITE ) before a handle is created or after it...

CVE-2026-110834 FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...