CVE-2026-111375

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

CVE-2026-111375

FreeRDP versions 3.0.0 before 3.32.0 are affected by an out-of-bounds read vulnerability in the Windows RAIL client . A malicious RDP server can exploit this by sending a non-NUL-terminated window title update. When the client processes a full-length WINDOW_ORDER_FIELD_TITLE update via wf_rail_wi...

CVE-2026-111375 FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

CVE-2026-111375 FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

CVE-2026-111375: Out-of-bounds Read

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

CVE-2021-28848

Mintty before 3.4.5 allows remote servers to cause a denial of service Windows GUI hang by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon...

CVE-2021-28847

MobaXterm before 21.0 allows remote servers to cause a denial of service Windows GUI hang via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls...

PT-2021-19673

Name of the Vulnerable Software and Affected Versions: EmTec ZOC versions prior to 8.02.5 Description: The issue allows remote servers to cause a denial of service, resulting in a Windows GUI hang. This occurs when the ZOC window is told to change its title repeatedly at high speed, leading to ma...

CVE-2021-32198: Undefined Security Weakness

EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service Windows GUI hang by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon...

CVE-2021-28848

Mintty before 3.4.5 allows remote servers to cause a denial of service Windows GUI hang by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon...

CVE-2021-28847: Undefined Security Weakness

MobaXterm before 21.0 allows remote servers to cause a denial of service Windows GUI hang via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls...

PT-2021-17964

Name of the Vulnerable Software and Affected Versions: Mintty versions prior to 3.4.5 Description: The issue allows remote servers to cause a denial of service, resulting in a Windows GUI hang, by repeatedly changing the Mintty window title at high speed. This leads to many SetWindowTextA or...

CVE-2021-28848: Allocation of Resources Without Limits or Throttling

Mintty before 3.4.5 allows remote servers to cause a denial of service Windows GUI hang by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon...

PT-2021-17963

Name of the Vulnerable Software and Affected Versions: MobaXterm versions prior to 21.0 Description: The issue allows remote servers to cause a denial of service, resulting in a Windows GUI hang, via tab title change requests sent repeatedly at high speed. This leads to many SetWindowTextA or...

Code injection

PuTTY before 0.75 on Windows allows remote servers to cause a denial of service Windows GUI hang by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs ...

CVE-2021-33500

PuTTY before 0.75 on Windows is vulnerable to a Denial of Service where a remote server repeatedly changes the window title at high speed, causing many SetWindowTextA/SetWindowTextW calls and a Windows GUI hang. The attack methodology may affect some OS-level GUIs on Linux or other platforms. CVE...

CVE-2021-33500: Undefined Security Weakness

PuTTY before 0.75 on Windows allows remote servers to cause a denial of service Windows GUI hang by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs ...