CVE-2026-121954

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

DEBIAN-CVE-2026-121954

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

CVE-2026-121954 FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

CVE-2026-121954 FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

CVE-2026-121954 FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

CVE-2026-121954: FreeRDP: FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset…

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

PT-2026-137006

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp bitmap planar context reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX...

GFX Component Code Execution

The vulnerability in the GFX component of Google Chrome and Microsoft Edge is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

PT-2026-128639

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx v6 0 init microcode is not released when the GFX block is torn down, leaking the firmware resources. Add gfx v6 0 free microcode and call it from gfx v6...

PT-2026-117003

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A firmware leak occurs during the teardown of the GFX block. The firmware requested via the gfx v6 0 init microcode function is not properly released, leading to a leak of firmware...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from client heap out-of-bounds writes in the generalLumaToYUV444 and generalChromaV2ToYUV444 functions. A malicious RDP server can send specially crafted RDP GFX AVC444 or AVC444v2 frames to corrupt th...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Starting from version 3.21.0 up to but including version 3.28.0, FreeRDP clients utilizing the GFX pipeline include an incomplete fix for CVE-2026-23530 in planardecompressplanerleonly within libfreerdp/codec/planar.c. This allows a...

Astra Linux – vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP-based clients running a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds reads. Versions 3.5.0 and 2.11.6 fix this issue. As a workaround, use the /gfx or /rfx modes enabled by default; server-side...

GFX Component Code Execution

The vulnerability of the GFX web browser components in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.96, read and write operations in GFX using Google Chrome allowed a remote attacker to perform arbitrary read/write operations through malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu/gfx: Disable gfx9 cpeccerrorirq only when enabling legacy gfx ras. gfx9 cpeccerrorirq is only enabled when legacy gfx ras is asserted. Therefore, in gfxv90hwfini, the interrupt disabling for cpeccerrorirq should be...

ROS-20260911-73-0028

The vulnerability of the GFX graphics subsystem in Google Chrome browsers and Linux operating systems relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failure...

CVE-2026-80576

A flaw was found in the Linux kernel's drm/amdgpu component. A local attacker could exploit this vulnerability by providing oversized input buffer IB bytes to the amdgpucsp2ib function on Graphics GFX rings. This lack of size validation allows the oversized values to corrupt adjacent control bits...

AZL-97845 CVE-2026-80576 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...