CVE-2026-22859 FreeRDP has a heap-buffer-overflow in urb_select_configuration

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSBINTERFACEDESCRIPTOR values and uses them as indices in libusbudevcompletemsconfigsetup, causing an out‑of‑bounds read. This vulnerability is...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001678)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001678 advisory. An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS...

FreeRDP 输入验证错误漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. An input validation error vulnerability exists in versions prior to FreeRDP 3.20.1, which stems from a URBDRC client not performing a bounds check on the server-supplied MSUSBINTERFACEDESCRIPTOR...

CVE-2025-68656

CVE-2025-68656 affects the ESP-IDF USB Host HID Driver. Before 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer while continuing to use a stale local pointer, causing an immediate use-after-free when processing attacker-controlled Report Descriptor lengths....

PT-2026-2939

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw where the URBDRC client does not validate server-provided MSUSB INTERFACE DESCRIPTOR values. This lack of bounds checki...

DEBIAN-CVE-2025-40275

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in sndusbmixercontrolsbadd In sndusbcreatestreams, for UAC version 3 devices, the Interface Association Descriptor IAD is retrieved via usbifnumtoif. If this call fails, a fallback...

UBUNTU-CVE-2025-40275

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in sndusbmixercontrolsbadd In sndusbcreatestreams, for UAC version 3 devices, the Interface Association Descriptor IAD is retrieved via usbifnumtoif. If this call fails, a fallback...

CVE-2025-40275

CVE-2025-40275 is a Linux kernel vulnerability in the ALSA USB audio path. For UAC v3 devices, snd_usb_create_streams() may retrieve the Interface Association Descriptor (IAD) with usb_ifnum_to_if(), and if that call fails the code may fall back to the next interface to set a BADD profile. The co...

CVE-2022-48701

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in sndusbparseaudiointerface There may be a bad USB audio device with a USB ID of 0x04fa, 0x4201 and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsi...

CVE-2022-48701 ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in sndusbparseaudiointerface There may be a bad USB audio device with a USB ID of 0x04fa, 0x4201 and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsi...

CVE-2022-48701

The CVE-2022-48701 issue is in the Linux kernel ALSA usb-audio driver: an out-of-bounds read can occur in __snd_usb_parse_audio_interface() when parsing a USB device (USB ID 0x04fa:0x4201) that has fewer than 4 interfaces. The fix is to validate the interface count before parsing. Public referenc...

CVE-2022-48701 ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in sndusbparseaudiointerface There may be a bad USB audio device with a USB ID of 0x04fa, 0x4201 and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsi...

CVE-2022-48701 ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in sndusbparseaudiointerface There may be a bad USB audio device with a USB ID of 0x04fa, 0x4201 and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsi...

CVE-2022-48701

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in sndusbparseaudiointerface There may be a bad USB audio device with a USB ID of 0x04fa, 0x4201 and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsi...

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.

...

AZL-8655 CVE-2022-25258 affecting package kernel for versions less than 5.15.26.1-1

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests ones with a large array index and ones associated with NULL function pointer retrieval. Memory corruption might occur...

CVE-2022-25258

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests ones with a large array index and ones associated with NULL function pointer retrieval. Memory corruption might occur...

Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability - Cisco Systems

Two vulnerabilities exist in the virtual private dial-up network VPDN solution when Point-to-Point Tunneling Protocol PPTP is used in certain Cisco IOS releases prior to 12.3. PPTP is only one of the supported tunneling protocols used to tunnel PPP frames within the VPDN solution. The first...

Design/Logic Flaw

The virtual private dial-up network VPDN component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service resource exhaustion via a series of PPTP sessions, related to the persistence of interface descriptor block IDB data structures after process termination, aka bug ID...