ica2tcp

About Ica2Tcp Ica2Tcp is a tool developed in C allowing to proxy any TCP connection inside a Citrix ICA connection. It is to Citrix what ssh -D is to SSH. Additional information can be found here: https://www.sstic.org/2022/presentation/ica2tcp/ Disclaimer This tool was developped as an internshi...

UniversalDVC

Universal Dynamic Virtual Channel connector for Remote Desktop Services UDVC Terminal Services or Remote Desktop Services are offering many hidden features for those who want to dig deeper. One of these services is the Dynamic Virtual Channel that enables us to communicate over an open RDP...

CVE-2026-7070-RDP-Clipboard-Hijacking-via-Virtual-Channel-Injection

CVE-2026-7070 – RDP Clipboard Hijacking via Virtual Channel Injection Program Code Python – simulated RDP clipboard rdpserversim.py - Simulated RDP server with trusted virtual channel from http.server import HTTPServer, BaseHTTPRequestHandler import json, threading clipboard = "" Simulate an RDP...

SocksOverRDP

Socks Over RDP / Socks Over Citrix This tool adds the capability of a SOCKS proxy to Terminal Services or Remote Desktop Services and Citrix XenApp/XenDesktop. It uses Dynamic Virtual Channel that enables us to communicate over an open RDP/Citrix connection without the need to open a new socket,...

CVE-2026-114042

A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

CVE-2026-114042

FreeRDP 3.32.0 is vulnerable to a use-after-free flaw in the drdynvc channel . The issue occurs because the software frees a pool-owned stream using the owned-stream deallocator when the totalLength is smaller than the chunk size. A malicious RDP server can exploit this by sending a single well-f...

CVE-2026-111377

A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service DoS by initiating a message on a static virtual channel and repeatedly sending data fragments without completing the transmission. Because the server fails to enforce cumulative size limits during message...

CVE-2026-111377 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

CVE-2026-110832

A flaw was found in FreeRDP. An authenticated remote client can trigger excessive memory consumption on the server by sending a crafted Dynamic Virtual Channel DVC message with an arbitrarily large declared length. Because the server immediately allocates and initializes the requested memory befo...

Fenrir

Fenrir Rilasciato come open source da NCC Group Plc - http://www.nccgroup.com/ Sviluppato da Dave Spencer, david dot spencer at nccgroup dot com http://www.github.com/nccgroup/Fenrir Rilasciato sotto AGPL, per maggiori informazioni vedere LICENSE Descrizione Fenrir è stato creato per dimostrare c...

CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

DEBIAN-CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948

FreeRDP versions before 3.31.0 are affected by an out-of-bounds write in the server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. An authenticated client can queue oversized channel messages, causing a buffer underflow that corrupts heap memory including live ...

CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

Linux Distros Unpatched Vulnerability : CVE-2026-91948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is...

PT-2026-92067

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description An out-of-bounds write issue exists in server-side static virtual channel handling when CHANNEL OPTION SHOW PROTOCOL is enabled. Authenticated clients can queue oversized channel messages, leading t...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeuerx We cannot dereference “skb” after calling vcc-push, because the skb is released...