CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

SocksOverRDP

Socks Over RDP / Socks Over Citrix Esta herramienta añade la capacidad de un proxy SOCKS a Terminal Services o Servicios de Escritorio Remoto y Citrix XenApp/XenDesktop. Utiliza Dynamic Virtual Channel Canal Virtual Dinámico que nos permite comunicarnos a través de una conexión RDP/Citrix abierta...

CVE-2026-7070-RDP-Clipboard-Hijacking-via-Virtual-Channel-Injection

CVE-2026-7070 – Secuestro del portapapeles de RDP mediante inyección de canal virtual Código del programa Python – portapapeles de RDP simulado root@kitploit: rdpserversim.py - Simulated RDP server with trusted virtual channel from http.server import HTTPServer, BaseHTTPRequestHandler import json...

ica2tcp

关于 Ica2Tcp Ica2Tcp 是一款用 C 语言开发的工具，允许在 Citrix ICA 连接内代理任意 TCP 连接。它之于 Citrix 就像 ssh -D 之于 SSH。 更多信息请参见：https://www.sstic.org/2022/presentation/ica2tcp/ 免责声明 本工具是作为实习项目开发的，目前仍在开发中。它按“原样”发布，因此部分代码仍有些杂乱。你可能会偶尔遇到崩溃。一个更干净的版本正在开发中，很快就会发布。 不过，欢迎任何关于此版本的意见！ 构建工具 服务器端独立二进制文件和客户端共享库都必须构建。 详情请参阅相应的 README：...

UniversalDVC

远程桌面服务通用动态虚拟通道连接器 UDVC 终端服务（或远程桌面服务）为想要深入探索的用户提供了许多隐藏功能。其中一项服务是动态虚拟通道，它使我们能够在开放的 RDP 连接上进行通信，而无需打开新的套接字、连接或防火墙端口。这些通道可用于向活跃网络设备隐藏数据、绕过防火墙、通过网络实现设备驱动程序，或仅仅帮助渗透测试人员传输数据。其可能性是无限的。 本项目创建的实际原因是 XFLTReaT。它可用于在隔离网络之上构建“VPN”，并最终允许通过跳板机进行测试，而无需请求防火墙更改。简而言之，它让渗透测试人员的工作更轻松。 工作原理 你需要在用于连接 RDP...

Fenrir

Fenrir 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.com/ 由 Dave Spencer 开发，david dot spencer at nccgroup dot com http://www.github.com/nccgroup/Fenrir 根据 AGPL 许可发布，更多信息请参阅 LICENSE 描述 Fenrir 的创建旨在证明通过 RDP 虚拟通道隧道传输网络流量是可行的，但它仍处于初期阶段。这个 PoC 旨在通过虚拟通道隧道传输 meterpreter 反向 HTTP shell。长期目标是创建一个功能完备的 sock...

SUSE CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-57157

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol RDP. FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled are vulnerable to an out-of-bounds heap read. A malicious RDP client can exploit this by manipulating the DeviceName a...

CVE-2026-57157 Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in...

Linux Distros Unpatched Vulnerability : CVE-2026-56297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback...

CVE-2026-56297

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages concurrently, causing...

DEBIAN-CVE-2026-56297

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages concurrently, causing...

CVE-2026-56297

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages concurrently, causing...

CVE-2026-56297

FreeRDP

CVE-2026-56297

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcmanchannelclose and dvcmancallonreceive due to improper synchronization of channelcallback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages concurrently, causing...

PT-2026-61006

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description A heap-based buffer overflow exists in the virtual channel forwarding mechanism. The process uses a fixed-size buffer without adequate bounds checking when forwarding data from a remote client to the...

PT-2026-56434

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description A heap use-after-free occurs in the Dynamic Virtual Channel drdynvc handling path due to improper synchronization of channel callback access. A malicious RDP server can trigger a race condition by...

Astra Linux – Vulnerability in freerdp3

FreeRDP before version 3.22.0 contains a use-after-free vulnerability in the dvcmanchannelclose and dvcmancallonreceive functions, due to improper synchronization of channel callback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages...