PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

Important: pcp

Issue Overview: A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. CVE-2026-16526 A signed integer overflow in the PCP pmGetPDU function can be...

CVE-2026-74556

CVE-2026-74556 – Linux kernel (scsi: libiscsi_tcp) Technical summary from provided documents: The vulnerability arises in the iSCSI path handling within the Linux kernel where iscsi_tcp_hdr_dissect() places the data segment of several PDUs into the fixed-size conn->data buffer (8192 bytes). Fo...

CVE-2026-74508

CVE-2026-74508 affects the Linux kernel Bluetooth HIDP path. The bug occurs in hidp_recv_ctrl_frame() and hidp_recv_intr_frame(): they read skb->data[0] before verifying the L2CAP SDU header, enabling an uninitialized-byte use from skb tailroom when an empty basic-mode SDU is received or when ...

EUVD-2026-59700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

PT-2026-73008

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi tcp: Bound SCSI Response data segment to the connection buffer iscsi tcp hdr dissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSI DEF MAX RECV SE...

CVE-2026-73241

A vulnerability in FreeRDP's server-side RDSTLS allows remote, unauthenticated attackers to bypass authentication. By sending a crafted capabilities PDU instead of the expected authentication request, an attacker can gain an authenticated session without valid credentials. Mitigation Do not enabl...

CVE-2026-68431

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the...

EUVD-2026-57039

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the...

DEBIAN-CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-73241 FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-72746

A flaw was found in FreeRDP. An unauthenticated remote attacker could bypass the server-side authentication in the RDSTLS Remote Desktop Services Transport Layer Security handshake. By sending a Capabilities PDU instead of the expected Authentication Request PDU, the server incorrectly processes...

CVE-2026-72746

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241...

CVE-2026-72746

...

EUVD-2026-56136

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...

CVE-2026-72746

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241...

CVE-2026-72746 FreeRDP before 3.30.0 RDSTLS Server Authentication Bypass via PDU-type Confusion

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...