401663 matches found
CVE-2026-55194
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
CVE-2026-55191
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...
CVE-2026-61326
creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-19234
IBM Power Systems firmware (FW1120.00, FW1110.00–.30, FW1060.00–.80) suffers CWE-121 stack-based buffer overflow in the host boot image validation path. An attacker with service processor access can inject a malicious code update image, achieving arbitrary host code execution with HIGH confidenti...
CVE-2026-19234 Power System Buffer Overflow
Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image,...
CVE-2026-69159
Removed by vendor...
CVE-2026-63633
FreeRDP prior to 3.28.0 contains a heap buffer overflow in freerdp_dsp_decode_opus (libfreerdp/codec/dsp.c). The function calls Stream_EnsureRemainingCapacity on context->common.buffer, but opus_decode actually writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-63633
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
EUVD-2026-62672
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-55192
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...
CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
CVE-2026-55194
In FreeRDP before 3.27.0, the function rpc_client_recv_fragment() in libfreerdp/core/gateway/rpc_client.c grows the reassembly buffer based solely on the server-declared alloc_hint rather than the actual StubLength, so a malicious TS Gateway can trigger a heap-buffer overflow write past the 4096-...
CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
CVE-2026-55194
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
EUVD-2026-62667
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...