Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-121412 | FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap mem | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121411 | FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121410 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dime | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121409 | FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies v | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121408 | FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a ref | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121407 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to cr | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121406 | FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the res | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121405 | FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memo | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121404 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121403 | FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silentl | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121402 | FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121401 | FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying n | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121400 | FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client C | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121399 | FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client all | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121398 | FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A ma | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121397 | FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121396 | FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by mal | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121395 | FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A mal | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121394 | FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Atta | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
| CVE | CVE-2026-121393 | FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose Win | freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 freerdp3 |
About
-
Send Feedback to @ubuntu_updates
