CVE-2026-111881 FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881 FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881 FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111880 FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

EUVD-2026-103338

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

CVE-2026-111880 FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

CVE-2026-111880

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

CVE-2026-111880

FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a heap out-of-bounds write within the server hash-callback NTLM path. The root cause is a failure to validate the MIC offset , allowing unauthenticated attackers to send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MI...

CVE-2026-111880

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.31 contains a security vulnerability. This vulnerability stems from the genericsetcmd and genericgetcmd functions in the usbgadget fuac1legacy module, which do not validate the bRequest index. They use the low half byte of ctrl-bRequest as the index for con-data, wher...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.9 contains a security vulnerability. This vulnerability arises from the ALSA line6 driver not verifying the size of playback data packets. As a result, the frame length originating from the IN endpoint is rescaled according to the playback frame size and then written in...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.34 contains a security vulnerability. This vulnerability stems from the ALSA ua101 driver’s detectusbformat function, which does not verify whether the wMaxPacketSize and bNrChannels of the capture and playback endpoints match. As a result, out-of-bounds write...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.11 contains security vulnerabilities. One of these vulnerabilities arises from sockmapalloc, which does not reject entries greater than INTMAX. Additionally, sockmapfree uses a signed int to iterate through the sks array, leading to integer overflows and potential...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the GUE REMSUM option not verifying the order of the checksum’s start value and the field offset. When the offset is less than the start value, underflow occurs, potentially leading to forwarded packets being written...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the function nvmetauthchallenge, which treats the output buffer as a void pointer. This leads to an incorrect calculation of sizeofd, resulting in the omission of 15 bytes from the fixed challenge header. The short...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.36 contains a security vulnerability. This vulnerability arises from the icdhcpinitoptions function, which appends the hostname, vendor-class, and client-ID options to a fixed 312-byte bootppkt.exten buffer. No boundary checks are performed for writing the hostname an...

CLSA-2026-1791949745 kernel: Fix of 69 CVEs

sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...