28 matches found
CVE-2026-55191
A flaw was found in FreeRDP. FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend are vulnerable to a heap-buffer-overflow. A malicious Remote Desktop Protocol RDP server can supply crafted surface dimensions, causing an undersized buffer to be allocated. This can lead to a...
CVE-2026-55192
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...
CVE-2026-55192
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...
CVE-2026-55191
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55192 FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...
CVE-2026-55192
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...
CVE-2026-55192 FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...
CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
EUVD-2026-62660
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55191
FreeRDP clients prior to 3.27.0 are vulnerable to a heap-buffer-overflow write in the RDPGFX AVC444 codec path. In libfreerdp/codec/h264.c, the function avc444_ensure_buffer() computes the intermediate YUV444 buffer size using 32-bit multiplication (piDstStride[x] * padDstHeight). A malicious RDP...
CVE-2026-75141
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...
UBUNTU-CVE-2026-68229
In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...
EUVD-2017-3884
Malware in sbrugna...
EUVD-2016-4754
Malware in sbrugna...
EUVD-2016-0853
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2016-0842
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation MMCO data, which allows remote attackers to...
CVE-2017-12311
A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media process to restart unexpectedly when it receives an illegal H.264 frame. The vulnerability is triggered by an H.264 frame that has an invalid...
Design/Logic Flaw
A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media process to restart unexpectedly when it receives an illegal H.264 frame. The vulnerability is triggered by an H.264 frame that has an invalid...