https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:49:02.839580+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:36203 ALSA-2026:36203 — Important: freerdp security update 2026-10-03T05:49:03.086931+00:00

Affected: AlmaLinux:10: freerdp, AlmaLinux:10: freerdp-devel, AlmaLinux:10: freerdp-libs, AlmaLinux:10: freerdp-server, AlmaLinux:10: libwinpr, AlmaLinux:10: libwinpr-devel

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07426 bdu:2026-07426 2026-10-03T05:49:03.087008+00:00 bdu:2026-07426 https://cve.radiocsirt.org/vuln/euvd-2026-341172 EUVD-2026-341172 2026-10-03T05:49:03.087026+00:00 EUVD-2026-341172 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40033 fkie_cve-2026-40033 2026-10-03T05:49:03.087039+00:00

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

 https://cve.radiocsirt.org/vuln/ghsa-xmr8-h8p4-932m GHSA-xmr8-h8p4-932m 2026-10-03T05:49:03.087063+00:00

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10948-1 openSUSE-SU-2026:10948-1 — freerdp-3.26.0-3.1 on GA media 2026-10-03T05:49:03.087079+00:00

freerdp-3.26.0-3.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:46393 RHSA-2026:46393 — Red Hat Security Advisory: freerdp security update 2026-10-03T05:49:03.087100+00:00

freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution

 https://cve.radiocsirt.org/vuln/rlsa-2026:36203 RLSA-2026:36203 — Important: freerdp security update 2026-10-03T05:49:03.087124+00:00

Affected: Rocky Linux:10: freerdp

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)

* freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)

* freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)

* freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22194-1 SUSE-SU-2026:22194-1 — Security update for freerdp 2026-10-03T05:49:03.087154+00:00

Security update for freerdp

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40033 UBUNTU-CVE-2026-40033 2026-10-03T05:49:03.087176+00:00

Affected: Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:Pro:24.04:LTS: freerdp2, Ubuntu:25.10: freerdp3, Ubuntu:26.04:LTS: freerdp3

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1470 WID-SEC-W-2026-1470 — FreeRDP: Mehrere Schwachstellen 2026-10-03T05:49:03.087211+00:00

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu verursachen oder nicht näher spezifizierte Angriffe durchzuführen.