CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242

FreeRDP prior to version 3.30.0 is affected. The vulnerability resides in winpr/libwinpr/sspi/Kerberos/kerberos.c within kerberos_DecryptMessage, where the peer-controlled GSS Wrap-token EC field is not bounded before use with RRC in IOV pointer offsets, enabling out-of-bounds reads and in-place ...

CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

AZL-95553 CVE-2026-73074 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone in src/textprop.c uses the proplen value from gettextprops to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for non...

CVE-2026-73074

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone in src/textprop.c uses the proplen value from gettextprops to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for non...

CVE-2026-72745

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242...

CVE-2026-72745

CVE-2026-72745 is a duplicate of CVE-2026-73242 for FreeRDP. Technical details in connected docs describe an out-of-bounds vulnerability in kerberos_DecryptMessage() within winpr/libwinpr/sspi/Kerberos/kerberos.c, where a peer-supplied 16-bit EC (extra count) in a GSS Wrap token can move decrypt ...

CVE-2026-72745

...

CVE-2026-72745 FreeRDP before 3.30.0 Out-of-Bounds Read via Kerberos GSS Wrap-token EC

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberosDecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field of a peer-supplied GSS Wrap token RFC 4121 is used directly in pointer arithmetic to locate the encrypted regions without being...

PT-2026-70249

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0841 Description The prop add one function in src/textprop.c uses the proplen value from get text props to increment a uint16 t property count. If the count exceeds 0xffff, it wraps around to zero, leading to a heap...

PT-2026-70158

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos DecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field of a peer-supplied GSS Wrap token RFC 4121 is used directly in pointer arithmetic to locate the encrypted regions without being...

CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

UBUNTU-CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

Alibaba Cloud Linux 3 : 0247: php:7.4 (ALINUX3-SA-2026:0247)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0247 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-14355: In PHP versions 8.2. before 8.2.32,...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3514-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3514-1 advisory. Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

Mermaid allows CSS injection applying to sibling elements of the diagram

Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with mermaid-X, sibling and + combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram . Most users of mermaid would not be affected by this...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

SUSE-SU-2026:3514-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...