{"kind": "product", "path": "vulns/ubuntu-25.10/freerdp3", "name": "freerdp3", "product": "freerdp3", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-55192", "noindex": false, "published": "2026-08-19T17:51:19.479Z", "modified": "2026-08-25T03:36:30.059Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0045, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55192", "title": "FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version ", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6", "https://github.com/FreeRDP/FreeRDP/pull/12873", "https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55194", "noindex": false, "published": "2026-08-19T17:50:30.158Z", "modified": "2026-08-27T16:25:00.719Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00619, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55194", "title": "FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx", "https://github.com/FreeRDP/FreeRDP/pull/12873", "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55648", "noindex": false, "published": "2026-08-19T17:48:51.223Z", "modified": "2026-08-21T21:49:23.791Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55648", "title": "FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This is", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6", "https://github.com/FreeRDP/FreeRDP/pull/12877", "https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55193", "noindex": false, "published": "2026-08-19T17:46:39.233Z", "modified": "2026-08-27T16:25:00.881Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00479, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55193", "title": "FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rp4-66mc-j9vx", "https://github.com/FreeRDP/FreeRDP/pull/12873", "https://github.com/FreeRDP/FreeRDP/commit/a863ef1cf1cdabf9019280e5658f806e73bb50e8"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55564", "noindex": false, "published": "2026-08-19T17:45:47.438Z", "modified": "2026-08-25T03:33:53.901Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00328, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55564", "title": "FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6xmj-pr98-cx4c", "https://github.com/FreeRDP/FreeRDP/pull/12885", "https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55191", "noindex": false, "published": "2026-08-19T17:44:52.392Z", "modified": "2026-08-19T18:17:07.147Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00619, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55191", "title": "FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-inf", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr", "https://github.com/FreeRDP/FreeRDP/pull/12873", "https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-57156", "noindex": false, "published": "2026-07-10T19:52:25.553Z", "modified": "2026-07-15T03:59:00.856Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00698, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57156", "title": "FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7", "https://github.com/FreeRDP/FreeRDP/pull/12938", "https://github.com/FreeRDP/FreeRDP/commit/487f35daccb36a6224e530dcd8fa60850825f823"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-57157", "noindex": false, "published": "2026-07-10T19:51:00.559Z", "modified": "2026-07-10T20:57:52.054Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00539, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57157", "title": "Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47fr-jw86-c3fj", "https://github.com/FreeRDP/FreeRDP/pull/12930", "https://github.com/FreeRDP/FreeRDP/pull/12945"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-57158", "noindex": false, "published": "2026-07-10T19:49:03.646Z", "modified": "2026-07-14T13:54:51.055Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0069, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57158", "title": "FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp", "https://github.com/FreeRDP/FreeRDP/pull/12952", "https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55827", "noindex": false, "published": "2026-07-10T19:47:03.498Z", "modified": "2026-07-15T03:58:59.199Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00533, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55827", "title": "FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp", "https://github.com/FreeRDP/FreeRDP/pull/12899", "https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56297", "noindex": false, "published": "2026-07-08T13:49:01.343Z", "modified": "2026-07-08T14:23:00.749Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00466, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56297", "title": "FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback", "description": "FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h", "https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback", "https://nvd.nist.gov/vuln/detail/CVE-2026-56297"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45700", "noindex": false, "published": "2026-05-29T19:44:12.385Z", "modified": "2026-07-29T12:04:39.795Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.06102, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45700", "title": "Heap-buffer-overflow write in planar bitmap decoder", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh", "https://access.redhat.com/security/cve/CVE-2026-45700", "https://bugzilla.redhat.com/show_bug.cgi?id=2483470"], "fixes": ["3.16.0+dfsg-2ubuntu0.5"], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44420", "noindex": false, "published": "2026-05-29T19:42:23.460Z", "modified": "2026-07-27T12:05:26.759Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.04557, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44420", "title": "FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3p3r", "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8", "https://access.redhat.com/security/cve/CVE-2026-44420"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44422", "noindex": false, "published": "2026-05-29T19:41:46.829Z", "modified": "2026-07-27T12:05:36.962Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00431, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44422", "title": "FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j9q5-7g8m-jc9v", "https://access.redhat.com/security/cve/CVE-2026-44422", "https://bugzilla.redhat.com/show_bug.cgi?id=2483467"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44421", "noindex": false, "published": "2026-05-29T19:40:25.492Z", "modified": "2026-07-27T12:05:30.051Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44421", "title": "FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff", "https://access.redhat.com/security/cve/CVE-2026-44421", "https://bugzilla.redhat.com/show_bug.cgi?id=2483471"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-40033", "noindex": false, "published": "2026-05-26T14:08:47.535Z", "modified": "2026-07-27T12:05:46.043Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01365, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40033", "title": "FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass", "description": "FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff", "https://github.com/FreeRDP/FreeRDP/pull/12713", "https://github.com/FreeRDP/FreeRDP/commit/d7508ebcd82842a691ae4941e5104d14240a89ae"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-40254", "noindex": false, "published": "2026-04-24T02:24:50.794Z", "modified": "2026-04-24T12:06:22.722Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40254", "title": "FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx", "https://nvd.nist.gov/vuln/detail/CVE-2026-40254"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-33995", "noindex": false, "published": "2026-03-30T21:43:49.873Z", "modified": "2026-04-02T14:13:21.632Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00293, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33995", "title": "FreeRDP: Possible double free in kerberos_AcceptSecurityContext", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS). The crash is triggered during NLA connection teardown and requires a failed authentication attempt. This issue has been patched in version 3.24.2.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx", "https://github.com/FreeRDP/FreeRDP/commit/8078b8af1359055972e4fb2f509f543b69169391", "https://nvd.nist.gov/vuln/detail/CVE-2026-33995"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-33987", "noindex": false, "published": "2026-03-30T21:43:39.943Z", "modified": "2026-03-31T15:32:44.898Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33987", "title": "FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This issue has been patched in version 3.24.2.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc", "https://github.com/FreeRDP/FreeRDP/commit/1a890eb43492b5eb707cb3dd6fc908f696e8fc1c", "https://nvd.nist.gov/vuln/detail/CVE-2026-33987"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-33986", "noindex": false, "published": "2026-03-30T21:43:21.951Z", "modified": "2026-07-15T01:05:01.229Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33986", "title": "FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write", "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.", "references": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97", "https://github.com/FreeRDP/FreeRDP/commit/f6e43e208958140074ae9bb93cd0c9045a371c77", "https://access.redhat.com/security/cve/CVE-2026-33986"], "fixes": [], "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}]}], "total": 78, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "freerdp3", "path": "vulns/ubuntu-25.10/freerdp3", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-27T16:25:00.881Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}