[Git][security-tracker-team/security-tracker][master] more issues from freerdp 3.31

Moritz Muehlenhoff (@jmm) jmm at debian.org
Fri Sep 4 22:56:47 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5f99e3f5 by Moritz Muehlenhoff at 2026-09-04T23:56:20+02:00
more issues from freerdp 3.31

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1170,6 +1170,97 @@ CVE-2026-85091 (zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overfl
 	NOTE: https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
 	NOTE: https://github.com/madler/zlib/commit/e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca
 	TODO: check details
+CVE-2026-XXXX [FreeRDP server DRDYNVC parser use-after-free during concurrent channel close]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6mpx-c8rj-whj5
+CVE-2026-XXXX [FreeRDP RDPGFX ResetGraphics discloses up to 300 bytes of uninitialized heap memory]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj
+CVE-2026-XXXX [Smartcard response lengths are not bounded to their inline ATR arrays]
+	- freerdp3 3.31.0+dfsg-1
+	[trixie] - freerdp3 <not-affected> (Only affects 3.28 and later)
+	- freerdp2 <not-affected> (Only affects 3.28 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r
+CVE-2026-XXXX [SHOW_PROTOCOL live-pointer overwrite]
+	- freerdp3 3.31.0+dfsg-1
+	[trixie] - freerdp3 <not-affected> (Only affects 3.28 and later)
+	- freerdp2 <not-affected> (Only affects 3.28 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26
+CVE-2026-XXXX [FreeRDP server continues after negotiation failure and dispatches a failure code as RDSTLS]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <not-affected> (Only affects 3.0 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
+CVE-2026-XXXX [RDPDR out-of-bounds read in rdpdr_dump_packet via UINT32 wraparound in 16 + computerNameLen guard]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4
+CVE-2026-XXXX [Out-of-bounds write in urb_send_current_frame_number_result]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <not-affected> (Only affects 3.14 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h5w2-q35j-443h
+CVE-2026-XXXX [Infinite loop / CPU DoS in pool_decode_rect]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <not-affected> (Only affects 3.11 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m85m-3qxv-63h5
+CVE-2026-XXXX [Heap buffer overflow in nego_send_negotiation_request via oversized LB_LOAD_BALANCE_INFO routing token]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6
+CVE-2026-XXXX [NULL pointer dereference in gdi_surface_bits when the client has not enabled NSCodec]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch
+CVE-2026-XXXX [FreeRDP: server stores client Core Data DesktopWidth/Height unvalidated in GCC negotiation]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4464-r7qj-pgrx
+CVE-2026-XXXX [URBDRC out-of-bounds read in func_get_ep_desc via InterfaceNumber/array-position index mismatch]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8
+CVE-2026-XXXX [Client-side heap OOB read in FreeRDP AVC444 chroma combine]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-57h7-vw2f-2f9x
+CVE-2026-XXXX [Uninitialised heap disclosure in FreeRDP Save Session Info PDU]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q
+CVE-2026-XXXX [channels,smartcard worker creation failure frees a devman-owned device]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j5mq-3349-gwmm
+CVE-2026-XXXX [Unbounded MonitorIds used as an array index in X11 monitor selection]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <not-affected> (Only affects 3.11 and later)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23pf-q83q-x45r
+CVE-2026-XXXX [rts_read_result length-checks 2 bytes and then reads 4]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438
+CVE-2026-XXXX [Stream_EnsureCapacity still overflows]
+	- freerdp3 3.31.0+dfsg-1
+	[trixie] - freerdp3 <not-affected> (Incomplete fix for CVE-2026-27951 never backported)
+	- freerdp2 <not-affected> (Incomplete fix for CVE-2026-27951 never backported)
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w9qg-g24r-77f6
+CVE-2026-XXXX [URBDRC/libusb control-transfer path aborts on reachable OutputBufferSize assertion]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w9qg-g24r-77f6
+CVE-2026-XXXX [audin Apple backends perform overflow-prone buffer size arithmetic from server-controlled values]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f5p6-88mh-59vg
+CVE-2026-XXXX [Disclosure of uninitialized heap memory in the urbdrc USB redirection path]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq
+CVE-2026-XXXX [Heap buffer overflow in nego_send_negotiation_request]
+	- freerdp3 3.31.0+dfsg-1
+	- freerdp2 <removed>
+	NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x
 CVE-2026-85090 (FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability ...)
 	- freerdp3 3.31.0+dfsg-1
 	- freerdp2 <removed>



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f99e3f5cd06249eed309a9f23b136c25325726b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f99e3f5cd06249eed309a9f23b136c25325726b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260904/15fcd6f1/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list