60 matches found
CVE-2026-67300
CVE-2026-67300 – FreeRDP before 3.29.0 : A client-side heap use-after-free in the async update message proxy affects RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. If a malicious RDP server sends crafted update orders, the proxy shallow-copies structures containi...
CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...
CVE-2026-67300
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...
CVE-2026-67300 FreeRDP before 3.29.0 Use-After-Free via async message proxy
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...
EUVD-2026-51820
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...
CVE-2026-67301 FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...
EUVD-2026-51857
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...
CVE-2026-67301 FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...
PT-2026-67281
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds read exists in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When the AsyncUpdate feature is enabled, the functions update message PolygonSC...
RHSA-2026:42240 Red Hat Security Advisory: Satellite 6.19.2.1 Async Update
Bulletin has no description...
RHSA-2026:42151 Red Hat Security Advisory: Satellite 6.18.7.1 Async Update
Bulletin has no description...
RHSA-2026:42150 Red Hat Security Advisory: Satellite 6.17.9.1 Async Update
Bulletin has no description...
RHSA-2026:42082 Red Hat Security Advisory: Satellite 6.16.11 Async Update
Bulletin has no description...
RHSA-2026:34367 Red Hat Security Advisory: Satellite 6.16.10 Async Update
Bulletin has no description...
RHSA-2026:28385 Red Hat Security Advisory: Satellite 6.18.6 Async Update
Bulletin has no description...
RHSA-2026:27076 Red Hat Security Advisory: Satellite 6.16.9 Async Update
Bulletin has no description...
RHSA-2026:22326 Red Hat Security Advisory: Satellite 6.19.1 Async Update
Bulletin has no description...
RHSA-2026:14835 Red Hat Security Advisory: Satellite 6.18.5 Async Update
Bulletin has no description...