CVE-2026-114052 vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...

CVE-2026-114052

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...

EUVD-2026-107003

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...

CVE-2026-114052 vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...

CVE-2026-114044

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized...

EUVD-2026-106995

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043 Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

EUVD-2026-106994

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

FreeRDP versions before 3.32.1 are vulnerable to a heap-based out-of-bounds read within the WinPR clipboard PNG-to-CF_DIB synthesis component. The root cause is that winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with a bit depth below 8, while winpr_bitmap_write_buffer() inc...

CVE-2026-114043 Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114041

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

CVE-2026-114041 FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

CVE-2026-114041 FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

EUVD-2026-106992

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

CVE-2026-114041

FreeRDP versions prior to 3.32.1 on Windows are vulnerable to a heap out-of-bounds read in the client_cli_present_gateway_message function. The root cause is the improper passing of a byte count as a wide-character printf precision. This allows a malicious RD Gateway to send pre-authentication co...

EUVD-2021-34890

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48020

Vyper versions 0.1.0b4 before 0.3.0 are vulnerable to a memory corruption issue (CWE-787) triggered by an incorrect stack tip pointer . This occurs when internal function calls are performed within arrays . Specifically, contracts that place internal calls in nested array elements, external call ...

CVE-2021-48020

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...