{"id":"CVE-2026-67290","aliases":["DEBIAN-CVE-2026-67290","EUVD-2026-51865","GHSA-v8g5-qxq2-3959","GHSA-whq8-c3v3-p8v8","RHSA-2026:68706","RHSA-2026:68707","UBUNTU-CVE-2026-67290"],"status":"published","title":"FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00616,"percentile":0.49815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-01T12:22:16Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.29.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1","3.32.1+dfsg-1","3.32.1+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-5.el7_9.12"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"]}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3","tags":["patch","Patch","fix","article","report"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf","tags":["third-party-advisory","Patch","Third Party Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67290","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v8g5-qxq2-3959"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67290.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67290","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68706","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68706.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55194","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12873","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63633","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12993","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63652","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9g22-w2gr-vcmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67288","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67290","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67291","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67296","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jm8r-22j6-4m4v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-rdpei-pdu","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67297","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2c6r-4pr4-9x8m","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-resource-exhaustion-via-chunked-http-response","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67298","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67301","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67304","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-null-dereference-via-smartcard-cleanup","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69159","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/75a1ec61d444179ea64a4ec0835214cb9c4f7c18","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/13016","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.29.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73241","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73241","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/13065","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6x","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73242","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73242","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68707","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68707.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55192","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-67290","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67290","title":"FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T12:22:16.59Z","modified":"2026-08-03T15:38:23.74Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-51865","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T12:22:16Z","modified":"2026-08-03T15:38:23Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:24.366648Z"}],"ghsa":[{"id":"GHSA-v8g5-qxq2-3959","title":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder...","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T15:30:25Z","modified":"2026-08-01T15:30:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:01.548476Z"}],"nvd":[{"id":"CVE-2026-67290","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T13:16:57.94Z","modified":"2026-09-29T16:17:35.323Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-67290","title":"FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T12:22:16.59Z","modified":"2026-10-28T02:30:58.050181361Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-67290","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T13:16:57.94Z","modified":"2026-09-30T09:00:20.881504438Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"RHSA-2026:68706","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2026-09-18T10:15:35Z","modified":"2026-09-30T10:16:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68707","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2026-09-18T10:15:35Z","modified":"2026-09-30T10:16:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-67290","description":"FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.","status":"published","published":"2026-08-01T13:16:00Z","modified":"2026-08-17T23:45:06.072560788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}