Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing relied on cbData/remaining length, and never validated against the minimum size implied by cx/cy. A malicious server could trigger a client-side global buffer overflow, resulting in a crash...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130081 advisory. FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with...

DEBIAN-CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-41210

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210

The Moonlight Qt GameStream client (versions 6.1.0 and earlier ) is vulnerable to a remote heap buffer overflow . When a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL if Moonlight selects a decoder path lacking CAPABILITY_REFERENCE_FRAME_INVAL...

DEBIAN-CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

DEBIAN-CVE-2026-109248

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr and countspecialchars calls without a NUL-termination guarantee. A malicious RDP server...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

EUVD-2026-97700

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP versions 3.10.0 through 3.32.2 are vulnerable to a heap buffer overflow within the WinPR png_write_data callback. The root cause is a failure to handle a realloc failure , which allows a malicious RDP clipboard peer to trigger an out-of-bounds memcpy by supplying a large CF_DIB image duri...

CVE-2026-109254 FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to...

PT-2026-110970

Name of the Vulnerable Software and Affected Versions Moonlight Qt versions prior to 6.2.0 Description A remote heap corruption occurs when a user initiates a streaming session to a malicious host. The host can send a crafted H.264 SPS NAL Network Abstraction Layer when the client selects a decod...

CVE-2026-109256: Heap-based Buffer Overflow

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

CVE-2026-107161

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...