Поиск уязвимостей
Количество 17
Количество 17
CVE-2026-67299
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
CVE-2026-67299
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
CVE-2026-67299
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
CVE-2026-67299
FreeRDP before 3.29.0 contains a client-side heap use-after-free in th ...
GHSA-jq8c-588g-4wgj
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
BDU:2026-10989
Уязвимость функции update_message_WindowIcon() RDP-клиента FreeRDP, позволяющая нарушителю вызвать повреждение памяти и отказ в обслуживании
ROS-20261020-80-0006
Уязвимость freerdp3
ROS-20261020-80-0005
Уязвимость freerdp
ROS-20261020-73-0004
Уязвимость freerdp3
RLSA-2026:54487
Important: freerdp security update
RLSA-2026:54485
Important: freerdp security update
ELSA-2026-54487
ELSA-2026-54487: freerdp security update (IMPORTANT)
ELSA-2026-54485
ELSA-2026-54485: freerdp security update (IMPORTANT)
RLSA-2026:54486
Important: freerdp security update
ELSA-2026-54486
ELSA-2026-54486: freerdp security update (IMPORTANT)
ALT-PU-2026-13711
ALT-PU-2026-13711: package `freerdp3` update to version 3.30.0-alt2
ALT-PU-2026-11763
ALT-PU-2026-11763: package `freerdp3` update to version 3.30.0-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash. | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash. | CVSS3: 6.5 | 0% Низкий | 3 месяца назад |
 | CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash. | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
| CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in th ... | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
| GHSA-jq8c-588g-4wgj FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash. | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | BDU:2026-10989 Уязвимость функции update_message_WindowIcon() RDP-клиента FreeRDP, позволяющая нарушителю вызвать повреждение памяти и отказ в обслуживании | CVSS3: 7.5 | 0% Низкий | 4 месяца назад |
 | ROS-20261020-80-0006 Уязвимость freerdp3 | CVSS3: 7.5 | 0% Низкий | 20 дней назад |
| ROS-20261020-80-0005 Уязвимость freerdp | CVSS3: 7.5 | 0% Низкий | 20 дней назад |
| ROS-20261020-73-0004 Уязвимость freerdp3 | CVSS3: 7.5 | 0% Низкий | 20 дней назад |
 | RLSA-2026:54487 Important: freerdp security update | 3 месяца назад | ||
| RLSA-2026:54485 Important: freerdp security update | 3 месяца назад | ||
| ELSA-2026-54487 ELSA-2026-54487: freerdp security update (IMPORTANT) | 3 месяца назад | ||
| ELSA-2026-54485 ELSA-2026-54485: freerdp security update (IMPORTANT) | 3 месяца назад | ||
| RLSA-2026:54486 Important: freerdp security update | 3 месяца назад | ||
| ELSA-2026-54486 ELSA-2026-54486: freerdp security update (IMPORTANT) | 3 месяца назад | ||
| ALT-PU-2026-13711 ALT-PU-2026-13711: package `freerdp3` update to version 3.30.0-alt2 | CVSS3: 9.8 | 3 месяца назад | |
| ALT-PU-2026-11763 ALT-PU-2026-11763: package `freerdp3` update to version 3.30.0-alt1 | CVSS3: 9.8 | 3 месяца назад |
Уязвимостей на страницу