🚨 CVE-2026-109247
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.
🎖@cveNotify
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.
🎖@cveNotify
GitHub
Clipboard file descriptors: server-supplied `cFileName` reaches the local `file://` URI unsanitised, allowing `..` traversal out…
This issue was found by Anthropic using Claude to study the security of open-source software, validated manually by
me from Ada Logics.
### Affected component
`winpr/libwinpr/clipboard/synth...
me from Ada Logics.
### Affected component
`winpr/libwinpr/clipboard/synth...
🚨 CVE-2026-109248
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.
🎖@cveNotify
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.
🎖@cveNotify
GitHub
WinPR clipboard: server-controlled `FILEDESCRIPTORW.cFileName` is scanned by `_wcschr()` without a NUL-termination guarantee —…
This issue was found by Anthropic using Claude to study the security of open-source software, validated manually by
me from Ada Logics.
## Summary
FreeRDP's WinPR clipboard converts a Wi...
me from Ada Logics.
## Summary
FreeRDP's WinPR clipboard converts a Wi...
🚨 CVE-2026-109249
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
🎖@cveNotify
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
🎖@cveNotify
GitHub
[common,assistance] tighten checks · FreeRDP/FreeRDP@2a737ce
FreeRDP is a free remote desktop protocol library and clients - [common,assistance] tighten checks · FreeRDP/FreeRDP@2a737ce
🚨 CVE-2026-109250
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.
🎖@cveNotify
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.
🎖@cveNotify
GitHub
PKCS#11 key enumeration writes past the fixed 64-entry `keys[]` array in `collect_keys()`
This issue was found by Anthropic using Claude to study the security of open-source software, validated manually by
me from Ada Logics
### Summary
`P11EnumKeysState` embeds a fixed array `NC...
me from Ada Logics
### Summary
`P11EnumKeysState` embeds a fixed array `NC...
🚨 CVE-2026-109251
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.
🎖@cveNotify
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.
🎖@cveNotify
GitHub
Server-chosen MS-RDPEVOR video geometry lets a malicious RDP server pick an out-of-range blit destination in the FreeRDP client
This issue was found by Anthropic using Claude to study the security of open-source software, validated manually
by me from Ada Logics.
## Summary
The MS-RDPEGT geometry dynamic virtual chan...
by me from Ada Logics.
## Summary
The MS-RDPEGT geometry dynamic virtual chan...
🚨 CVE-2026-109252
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.
🎖@cveNotify
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.
🎖@cveNotify
GitHub
[RDPEAR] Truncated KERB_RPC_INTERNAL_NAME causes a client near-NULL dereference during cleanup
# [RDPEAR] Truncated KERB_RPC_INTERNAL_NAME causes a client near-NULL dereference during cleanup
> Private security report. Please keep this report and its attachments private
> during tr...
> Private security report. Please keep this report and its attachments private
> during tr...
🚨 CVE-2026-112510
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service.
🎖@cveNotify
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113934
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113935
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113936
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113937
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113938
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113940
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113941
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113942
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113944
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-113946
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Golden Gate 27.2 - Apple Support
This document describes the security content of macOS Golden Gate 27.2.
🚨 CVE-2026-91903
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
🎖@cveNotify
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
🎖@cveNotify
🚨 CVE-2026-91904
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
🎖@cveNotify
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
🎖@cveNotify
🚨 CVE-2026-91905
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
🎖@cveNotify
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
🎖@cveNotify
🚨 CVE-2026-91906
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
🎖@cveNotify
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
🎖@cveNotify