Количество 11
Количество 11
BDU:2026-14961
Уязвимость функции rpc_recv_bind_ack_pdu() файла libfreerdp/core/gateway/rpc_bind.c RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
ROS-20260824-80-0007
Уязвимость freerdp3
ROS-20260824-73-0008
Уязвимость freerdp3
RLSA-2026:66349
Important: freerdp security update
RLSA-2026:66347
Important: freerdp security update
ELSA-2026-66349-0
ELSA-2026-66349-0: freerdp security update (IMPORTANT)
ELSA-2026-66347-0
ELSA-2026-66347-0: freerdp security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-14961 Уязвимость функции rpc_recv_bind_ack_pdu() файла libfreerdp/core/gateway/rpc_bind.c RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.8 | 0% Низкий | 4 месяца назад |
 | CVE-2026-55193 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0. | 0% Низкий | около 1 месяца назад | |
 | CVE-2026-55193 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0. | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-55193 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0. | 0% Низкий | около 1 месяца назад | |
| CVE-2026-55193 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ... | 0% Низкий | около 1 месяца назад | |
 | ROS-20260824-80-0007 Уязвимость freerdp3 | CVSS3: 9.8 | 0% Низкий | около 1 месяца назад |
| ROS-20260824-73-0008 Уязвимость freerdp3 | CVSS3: 9.8 | 0% Низкий | около 1 месяца назад |
 | RLSA-2026:66349 Important: freerdp security update | 0% Низкий | 13 дней назад | |
| RLSA-2026:66347 Important: freerdp security update | 0% Низкий | 13 дней назад | |
| ELSA-2026-66349-0 ELSA-2026-66349-0: freerdp security update (IMPORTANT) | 0% Низкий | 13 дней назад | |
| ELSA-2026-66347-0 ELSA-2026-66347-0: freerdp security update (IMPORTANT) | 0% Низкий | 14 дней назад |
Уязвимостей на страницу