https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:33:23 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:54486 <p><strong>Affected:</strong> AlmaLinux:10: freerdp, AlmaLinux:10: freerdp-devel, AlmaLinux:10: freerdp-libs, AlmaLinux:10: freerdp-server, AlmaLinux:10: libwinpr, AlmaLinux:10: libwinpr-devel</p> <p>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.</p> <p>Security Fix(es):</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: freerdp, AlmaLinux:10: freerdp-devel, AlmaLinux:10: freerdp-libs, AlmaLinux:10: freerdp-server, AlmaLinux:10: libwinpr, AlmaLinux:10: libwinpr-devel</p> <p>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.</p> <p>Security Fix(es):</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:54486 https://cve.radiocsirt.org/vuln/bdu:2026-10238 bdu:2026-10238 https://cve.radiocsirt.org/vuln/bdu:2026-10238 https://cve.radiocsirt.org/vuln/euvd-2026-339102 EUVD-2026-339102 https://cve.radiocsirt.org/vuln/euvd-2026-339102 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64620 <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64620 https://cve.radiocsirt.org/vuln/ghsa-xmhx-cqxp-qrgq <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> https://cve.radiocsirt.org/vuln/ghsa-xmhx-cqxp-qrgq https://cve.radiocsirt.org/vuln/rhsa-2026:54486 <p>FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow</p> <p>FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow</p> https://cve.radiocsirt.org/vuln/rhsa-2026:54486 https://cve.radiocsirt.org/vuln/rhsa-2026:58711 <p>FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow</p> <p>FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow</p> https://cve.radiocsirt.org/vuln/rhsa-2026:58711 https://cve.radiocsirt.org/vuln/rlsa-2026:54486 <p><strong>Affected:</strong> Rocky Linux:10: freerdp</p> <p>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.</p> <p>Security Fix(es):</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)</p> <p>* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)</p> <p>* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)</p> <p>* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)</p> <p>* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: freerdp</p> <p>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.</p> <p>Security Fix(es):</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)</p> <p>* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)</p> <p>* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)</p> <p>* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)</p> <p>* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)</p> <p>* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:54486 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-64620 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:Pro:24.04:LTS: freerdp2, Ubuntu:26.04:LTS: freerdp3</p> <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:Pro:24.04:LTS: freerdp2, Ubuntu:26.04:LTS: freerdp3</p> <p>FreeRDP before 3.28.0 (affected &lt;=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller&#39;s output buffer via BN_bn2bin() and only afterward checks output_length &gt; out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-64620 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2209 <p>Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2209