CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121952

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

CVE-2026-121955 FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955

FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free vulnerability within the Emulate_SCardReleaseContext function. The root cause is that the emulated SCardContext is freed before its associated worker thread is cancelled and joined. A malicious server can trigger this by sending ...

EUVD-2026-116955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121952 FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

EUVD-2026-116952

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

CVE-2026-121952

FreeRDP versions before 3.32.2 are vulnerable to an out-of-bounds write within the proxy component. The root cause is that the function rdp_read_bitmap_cache_v2_capability_set only rejects numCellCaches values greater than 5, but the application subsequently accesses the bitmap cache v2 cell arra...

CVE-2026-100408

In Git for Windows (versions 2.43.0.windows.1 through 2.55.0.windows.3 ), a heap overflow exists in contrib/credential/wincred/git-credential-wincred.c. When erasing a git:* credential that contains a password field, the match_cred_password() function incorrectly calculates the destination capaci...

CVE-2026-100407

In Git for Windows versions 2.44.0.windows.1 through 2.55.0.windows.3 , a heap overflow exists in the git-credential-wincred store operation located in contrib/credential/wincred/git-credential-wincred.c. The vulnerability occurs because _scwprintf() fails to account for the terminating NUL chara...

tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data

A flaw was found in Tesseract. The FullyConnected::DeSerialize function does not properly validate the dimensions of deserialized layers against the weight-matrix dimensions. This vulnerability allows a remote attacker to provide a specially crafted .traineddata file, leading to a heap...

tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A local attacker could provide a specially crafted .traineddata file, which, when processed, could lead to a heap out-of-bounds write. This vulnerability occurs due to unvalidated counts used as loop bounds...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A heap out-of-bounds write vulnerability exists in the GenericVector::read function when processing a specially crafted .traineddata model. By manipulating the reserved and sizeused fields, a local attacker ca...

CVE-2020-16947

CVE-2020-16947 This vulnerability occurs in Outlook 2019 16.0.13231.20262 installed on Windows 10 1909 x64 TLDR; I found this bug using winafl fuzzer. This bug occured when parsing html contents. if attacker successfully executes this exploit, it can lead to remote command execution. Details 0:00...

CVE-2025-60458

CVE-2025-60458 UxPlay 1.72 RTSP TEARDOWN Double Free Vulnerability Description UxPlay version 1.72 contains a double free vulnerability in its RTSP request handling logic. A remote attacker can trigger multiple calls to free on the same heap memory object by sending a specially crafted RTSP...

CVE-2026-45447

🚨 CVE-2026-45447 - Critical OpenSSL Use-After-Free Vulnerability Heap Use-After-Free in PKCS7verify allowing memory corruption, crashes, and potential remote code execution. 📖 Executive Summary CVE-2026-45447 is a critical vulnerability in OpenSSL's PKCS7 verification functionality. The flaw exis...

PT-2026-136994

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git: credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c...

CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses scwprintf to size a formatted wide-character credential buffer without space for the terminating NUL whe...

CVE-2026-121952: FreeRDP: FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects…

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

CVE-2026-100408: git-for-windows git: Git for Windows is the Windows port of Git

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git: credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c...