CVE-2026-111380 FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111380 FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111380

FreeRDP versions 3.29.0 before 3.32.0 are vulnerable to a heap overflow in the Apple audin backends (specifically audin_mac.m and audin_ios.m). The root cause is an integer overflow occurring during the calculation of the audio queue buffer size using UINT32 arithmetic. A malicious RDP server can...

CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

EUVD-2026-102536

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error...

EUVD-2026-102530

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

EUVD-2026-102525

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

EUVD-2026-102471

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

CVE-2026-89062

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error...

CVE-2026-89062: Out-of-bounds Write

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error...

CVE-2026-111627: Incorrect Authorization

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOTUSER administrators to perform write actions while impersonating the protected ROOTUSER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never...

PT-2026-115386

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.29.0 through 3.31.0 Description An integer overflow exists in the Apple audin backends audin mac.m, audin ios.m. The issue occurs during the calculation of the audio queue buffer size using the formula FramesPerPacket 2...

UBUNTU-CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

UBUNTU-CVE-2026-111151

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

UBUNTU-CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

PT-2026-115586

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...

Important: mariadb118

Issue Overview: A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the...

UBUNTU-CVE-2026-111105

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

Important: mariadb1011

Issue Overview: A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the...

PT-2026-115388

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.0 Description A client-side heap out-of-bounds write exists in the general LumaToYUV444 and general ChromaV2ToYUV444 functions. This allows a malicious RDP server to corrupt client memory by sending RDPGFX AVC444...