https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-121412/https://vulnfeed.org/cve/CVE-2026-121412/Tue, 03 Nov 2026 14:28:11 +0000FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.https://vulnfeed.org/cve/CVE-2026-121409/https://vulnfeed.org/cve/CVE-2026-121409/Tue, 03 Nov 2026 14:28:09 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.https://vulnfeed.org/cve/CVE-2026-121407/https://vulnfeed.org/cve/CVE-2026-121407/Tue, 03 Nov 2026 14:28:08 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.https://vulnfeed.org/cve/CVE-2026-121404/https://vulnfeed.org/cve/CVE-2026-121404/Tue, 03 Nov 2026 14:28:06 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.https://vulnfeed.org/cve/CVE-2026-121402/https://vulnfeed.org/cve/CVE-2026-121402/Tue, 03 Nov 2026 14:28:04 +0000FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.https://vulnfeed.org/cve/CVE-2026-121400/https://vulnfeed.org/cve/CVE-2026-121400/Tue, 03 Nov 2026 14:28:03 +0000FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.https://vulnfeed.org/cve/CVE-2026-121398/https://vulnfeed.org/cve/CVE-2026-121398/Tue, 03 Nov 2026 14:28:01 +0000FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.https://vulnfeed.org/cve/CVE-2026-121394/https://vulnfeed.org/cve/CVE-2026-121394/Tue, 03 Nov 2026 14:27:59 +0000FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.https://vulnfeed.org/cve/CVE-2026-121395/https://vulnfeed.org/cve/CVE-2026-121395/Tue, 03 Nov 2026 14:27:59 +0000FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.https://vulnfeed.org/cve/CVE-2026-121393/https://vulnfeed.org/cve/CVE-2026-121393/Tue, 03 Nov 2026 14:27:58 +0000FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.https://vulnfeed.org/cve/CVE-2026-121392/https://vulnfeed.org/cve/CVE-2026-121392/Tue, 03 Nov 2026 14:27:57 +0000FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.https://vulnfeed.org/cve/CVE-2026-121388/https://vulnfeed.org/cve/CVE-2026-121388/Tue, 03 Nov 2026 14:27:55 +0000FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.https://vulnfeed.org/cve/CVE-2026-121386/https://vulnfeed.org/cve/CVE-2026-121386/Tue, 03 Nov 2026 14:27:53 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.