DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Advisory ansehen veröffentlicht 2026-08-26
Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
beschreibt (23)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-111380US | high8.8 | — | ||
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket… | ||||
| CVE-2026-91964US | high8.8 | — | ||
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBa… | ||||
| CVE-2026-91963US | medium6.5 | — | ||
FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB tr… | ||||
| CVE-2026-91962US | medium6.3 | — | ||
FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted Fra… | ||||
| CVE-2026-91961US | medium6.5 | — | ||
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb… | ||||
| CVE-2026-91960US | medium6.5 | — | ||
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious R… | ||||
| CVE-2026-91959US | medium6.5 | — | ||
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU… | ||||
| CVE-2026-91958US | — | — | ||
FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can cr… | ||||
| CVE-2026-91957US | low3.1 | — | ||
FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigg… | ||||
| CVE-2026-91956US | medium6.5 | — | ||
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol f… | ||||
| CVE-2026-91955US | high7.5 | — | ||
FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can s… | ||||
| CVE-2026-91954US | medium6.5 | — | ||
FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can… | ||||
| CVE-2026-91953US | — | — | ||
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before w… | ||||
| CVE-2026-91952US | medium6.5 | — | ||
FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rectangles than prealloc… | ||||
| CVE-2026-91951US | medium6.5 | — | ||
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server c… | ||||
| CVE-2026-91950US | medium6.5 | — | ||
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malici… | ||||
| CVE-2026-91949US | critical9.3 | — | ||
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server polic… | ||||
| CVE-2026-91948US | — | — | ||
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticat… | ||||
| CVE-2026-91947US | high7.5 | — | ||
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Aut… | ||||
| CVE-2026-91946US | medium6.5 | — | ||
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fix… | ||||
20 von 23 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2026-75570 vom 2026-10-06external
- Red Hat Security Advisory RHSA-2026:73979 vom 2026-09-30external
- Red Hat Security Advisory RHSA-2026:74471 vom 2026-10-01external
- Red Hat Security Advisory RHSA-2026:75570 vom 2026-10-05external
- Red Hat Security Advisory RHSA-2026:76747 vom 2026-10-06external
- Red Hat Security Advisory RHSA-2026:76755 vom 2026-10-08external
- Amazon Linux Security Advisory ALAS2-2026-3938 vom 2026-09-29external
- Rocky Linux Security Advisory RLSA-2026:73979 vom 2026-10-02external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan