CVE-2026-109265 ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash...

CVE-2026-109265

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash...

CVE-2026-109265

The ImageMagick software versions 7.1.1-7 before 7.1.2-32 are vulnerable to a heap buffer over-read (CWE-125). The root cause is an incorrect string termination in XMP profiles , which allows an attacker to supply a crafted image with a malformed XMP profile to trigger the over-read and potential...

EUVD-2026-97709

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash...

CVE-2026-109265 ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash...

CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP versions 3.10.0 through 3.32.2 are vulnerable to a heap buffer overflow within the WinPR png_write_data callback. The root cause is a failure to handle a realloc failure , which allows a malicious RDP clipboard peer to trigger an out-of-bounds memcpy by supplying a large CF_DIB image duri...

EUVD-2026-97700

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a heap buffer overflow caused by an integer truncation vulnerability in license_check_stream_length. A malicious RDP server can exploit this by sending a crafted SERVER_LICENSE_REQUEST with a large scopeCount, which bypasses existing length c...

EUVD-2026-97699

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109250 FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

CVE-2026-109250

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

CVE-2026-109250

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

EUVD-2026-97694

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

CVE-2026-109250

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a heap buffer overflow within the collect_keys() function during PKCS#11 key enumeration. A local attacker who controls smartcard tokens can trigger the overflow by presenting more than 64 public key objects across multiple slots. This allows...