Vulnerability-Lookup

CVE-2026-31883 (GCVE-0-2026-31883)

Vulnerability from cvelistv5 – Published: 2026-03-13 17:35 – Updated: 2026-03-16 17:02

Title

FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 17:02 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)
CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/16df230…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
FreeRDP	FreeRDP	Affected: < 3.24.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31883",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T17:02:49.465233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T17:02:52.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T17:35:17.411Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
        }
      ],
      "source": {
        "advisory": "GHSA-85x9-4xxp-xhm5",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31883",
    "datePublished": "2026-03-13T17:35:17.411Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-03-16T17:02:52.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31883",
      "date": "2026-10-14",
      "epss": "0.0033",
      "percentile": "0.24422"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "FreeRDP",
                "vendor": "FreeRDP",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.24.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "97FCA262-35C3-4B6B-A321-15CE780FCA20",
                    "versionEndExcluding": "3.24.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0."
          },
          {
            "lang": "es",
            "value": "FreeRDP es una implementaci\u00f3n gratuita del Protocolo de Escritorio Remoto. Anterior a la 3.24.0, un subdesbordamiento de size_t en los decodificadores de audio IMA-ADPCM y MS-ADPCM conduce a una escritura de desbordamiento de b\u00fafer de pila a trav\u00e9s del canal de audio RDPSND. En libfreerdp/codec/dsp.c, los decodificadores IMA-ADPCM y MS-ADPCM restan tama\u00f1os de encabezado de bloque de una variable size_t sin comprobar si hay subdesbordamiento. Cuando nBlockAlign (recibido del servidor) se establece de tal manera que size % block_size == 0 activa el an\u00e1lisis del encabezado en un punto donde size es menor que el encabezado (4 u 8 bytes), la resta envuelve size a ~SIZE_MAX. El bucle while (size \u0026gt; 0) entonces contin\u00faa por un n\u00famero astron\u00f3mico de iteraciones. Esta vulnerabilidad se corrige en la 3.24.0."
          }
        ],
        "id": "CVE-2026-31883",
        "lastModified": "2026-06-17T10:34:41.517",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-31883",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T17:02:49.465233Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-13T19:54:37.190",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              },
              {
                "lang": "en",
                "value": "CWE-191"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T12:08:59+00:00",
      "cve": "CVE-2026-31883",
      "id": "CVE-2026-31883",
      "initial_release_date": "2026-03-13T17:35:17.411000+00:00",
      "product_status:fixed": "781",
      "product_status:known_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "freerdp: FreeRDP: Denial of Service via crafted audio data in RDP",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31883.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-31883",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-16T17:02:49.465233Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-16T17:02:44.300Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "FreeRDP",
              "vendor": "FreeRDP",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.24.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-191",
                  "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-13T17:35:17.411Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
            },
            {
              "name": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
            }
          ],
          "source": {
            "advisory": "GHSA-85x9-4xxp-xhm5",
            "discovery": "UNKNOWN"
          },
          "title": "FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-31883",
        "datePublished": "2026-03-13T17:35:17.411Z",
        "dateReserved": "2026-03-09T21:59:02.686Z",
        "dateUpdated": "2026-03-16T17:02:52.737Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

OESA-2026-2039 (CVE-2026-26955)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

freerdp security update

Details

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.(CVE-2026-31885)

FreeRDP is an open-source Remote Desktop Protocol (RDP) client. An integer underflow vulnerability exists in the implementation of its Progressive codec. By sending a specially crafted RDP packet, an attacker can trigger an underflow of a BYTE (unsigned 8-bit integer) variable, leading to undefined behavior (UB). This may cause the application to crash or enter an infinite loop, consuming excessive CPU resources and resulting in a denial-of-service (DoS) condition. The vulnerability stems from insufficient boundary checks on input data.(CVE-2026-33983)

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client. A heap out-of-bounds write vulnerability exists in the resize_vbar_entry() function of its ClearCodec component when processing specific video data. An attacker can craft a malicious RDP packet to trigger this vulnerability, potentially leading to remote code execution or service crash.(CVE-2026-33984)

Severity

9.3 (Critical)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-26955	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-26965	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31806	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31883	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31885	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33983	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33984	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "freerdp-2.11.8-3.oe2403.aarch64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403.aarch64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403.aarch64.rpm",
          "freerdp-devel-2.11.8-3.oe2403.aarch64.rpm",
          "freerdp-help-2.11.8-3.oe2403.aarch64.rpm",
          "libwinpr-2.11.8-3.oe2403.aarch64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403.aarch64.rpm"
        ],
        "src": [
          "freerdp-2.11.8-3.oe2403.src.rpm"
        ],
        "x86_64": [
          "freerdp-2.11.8-3.oe2403.x86_64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403.x86_64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403.x86_64.rpm",
          "freerdp-devel-2.11.8-3.oe2403.x86_64.rpm",
          "freerdp-help-2.11.8-3.oe2403.x86_64.rpm",
          "libwinpr-2.11.8-3.oe2403.x86_64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "freerdp",
        "purl": "pkg:rpm/openEuler/freerdp\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.8-3.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026amp;apos;s open specifications. This package provides the client applications xfreerdp.\r\n\r\nSecurity Fix(es):\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd-\u0026gt;left`/`cmd-\u0026gt;top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface-\u0026gt;data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct\u0026apos;s `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command \u2014 full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar-\u0026gt;pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and  on the brk heap (desktop \u2264 128\u00d7128), an adjacent `NSC_CONTEXT` struct\u0026apos;s `decode` function pointer is overwritten with attacker-controlled pixel data \u2014 control-flow\u2013relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc-\u0026gt;decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u0026gt; 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.(CVE-2026-31885)\n\nFreeRDP is an open-source Remote Desktop Protocol (RDP) client. An integer underflow vulnerability exists in the implementation of its Progressive codec. By sending a specially crafted RDP packet, an attacker can trigger an underflow of a BYTE (unsigned 8-bit integer) variable, leading to undefined behavior (UB). This may cause the application to crash or enter an infinite loop, consuming excessive CPU resources and resulting in a denial-of-service (DoS) condition. The vulnerability stems from insufficient boundary checks on input data.(CVE-2026-33983)\n\nFreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client. A heap out-of-bounds write vulnerability exists in the `resize_vbar_entry()` function of its ClearCodec component when processing specific video data. An attacker can craft a malicious RDP packet to trigger this vulnerability, potentially leading to remote code execution or service crash.(CVE-2026-33984)",
  "id": "OESA-2026-2039",
  "modified": "2026-08-06T11:11:02Z",
  "published": "2026-04-25T11:11:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2039"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26955"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26965"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31806"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31883"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31885"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33983"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33984"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "freerdp security update",
  "upstream": [
    "CVE-2026-26955",
    "CVE-2026-26965",
    "CVE-2026-31806",
    "CVE-2026-31883",
    "CVE-2026-31885",
    "CVE-2026-33983",
    "CVE-2026-33984"
  ]
}

OESA-2026-2040 (CVE-2026-26955)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

freerdp security update

Details

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

Severity

9.3 (Critical)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-26955	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-26965	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31806	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31883	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-31885	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33983	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33984	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "freerdp-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-devel-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-help-2.11.8-3.oe2403sp1.aarch64.rpm",
          "libwinpr-2.11.8-3.oe2403sp1.aarch64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "freerdp-2.11.8-3.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "freerdp-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-devel-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-help-2.11.8-3.oe2403sp1.x86_64.rpm",
          "libwinpr-2.11.8-3.oe2403sp1.x86_64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "freerdp",
        "purl": "pkg:rpm/openEuler/freerdp\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.8-3.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026amp;apos;s open specifications. This package provides the client applications xfreerdp.\r\n\r\nSecurity Fix(es):\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd-\u0026gt;left`/`cmd-\u0026gt;top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface-\u0026gt;data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct\u0026apos;s `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command \u2014 full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar-\u0026gt;pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and  on the brk heap (desktop \u2264 128\u00d7128), an adjacent `NSC_CONTEXT` struct\u0026apos;s `decode` function pointer is overwritten with attacker-controlled pixel data \u2014 control-flow\u2013relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc-\u0026gt;decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u0026gt; 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.(CVE-2026-31885)\n\nFreeRDP is an open-source Remote Desktop Protocol (RDP) client. An integer underflow vulnerability exists in the implementation of its Progressive codec. By sending a specially crafted RDP packet, an attacker can trigger an underflow of a BYTE (unsigned 8-bit integer) variable, leading to undefined behavior (UB). This may cause the application to crash or enter an infinite loop, consuming excessive CPU resources and resulting in a denial-of-service (DoS) condition. The vulnerability stems from insufficient boundary checks on input data.(CVE-2026-33983)\n\nFreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client. A heap out-of-bounds write vulnerability exists in the `resize_vbar_entry()` function of its ClearCodec component when processing specific video data. An attacker can craft a malicious RDP packet to trigger this vulnerability, potentially leading to remote code execution or service crash.(CVE-2026-33984)",
  "id": "OESA-2026-2040",
  "modified": "2026-08-06T11:11:02Z",
  "published": "2026-04-25T11:11:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2040"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26955"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26965"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31806"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31883"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31885"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33983"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33984"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "freerdp security update",
  "upstream": [
    "CVE-2026-26955",
    "CVE-2026-26965",
    "CVE-2026-31806",
    "CVE-2026-31883",
    "CVE-2026-31885",
    "CVE-2026-33983",
    "CVE-2026-33984"
  ]
}

OPENSUSE-SU-2026:10408-1

Vulnerability from csaf_opensuse - Published: 2026-03-23 00:00 - Updated: 2026-09-17 16:58

Summary

freerdp-3.24.1-1.1 on GA media

Severity

Moderate

Scope

19 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Recommended: 60 products

Open the full advisory

OPENSUSE-SU-2026:10459-1

Vulnerability from csaf_opensuse - Published: 2026-03-29 00:00 - Updated: 2026-09-17 16:59

Summary

freerdp2-2.11.7-6.1 on GA media

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Recommended: 28 products

Open the full advisory

OPENSUSE-SU-2026:20632-1

Vulnerability from csaf_opensuse - Published: 2026-04-27 13:16 - Updated: 2026-09-17 17:31

Summary

Security update for freerdp2

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Recommended: 28 products

Open the full advisory

OPENSUSE-SU-2026:20657-1

Vulnerability from csaf_opensuse - Published: 2026-04-30 16:54 - Updated: 2026-09-17 17:31

Summary

Security update for freerdp

Severity

Important

Scope

28 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Recommended: 60 products

Open the full advisory

RHSA-2026:16014

Vulnerability from csaf_redhat - Published: 2026-05-11 16:22 - Updated: 2026-10-06 17:09

Summary

Red Hat Security Advisory: freerdp security update

Severity

Moderate

Scope

10 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A remote attacker can exploit a size_t underflow vulnerability in the IMA-ADPCM and MS-ADPCM audio decoders by sending specially crafted audio data over the RDPSND audio channel. This underflow leads to a heap-buffer-overflow write, which can result in a denial of service for the FreeRDP client.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:16014

Open the full advisory

RHSA-2026:16019

Vulnerability from csaf_redhat - Published: 2026-05-11 16:30 - Updated: 2026-10-06 17:09

Summary

Red Hat Security Advisory: freerdp security update

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:16019

Open the full advisory

RHSA-2026:16482

Vulnerability from csaf_redhat - Published: 2026-05-13 01:05 - Updated: 2026-10-06 17:09

Summary

Red Hat Security Advisory: freerdp security update

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:16482

Open the full advisory

RHSA-2026:16483

Vulnerability from csaf_redhat - Published: 2026-05-12 23:31 - Updated: 2026-10-06 17:10

Summary

Red Hat Security Advisory: freerdp security update

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2026-31883.

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fixed: 35 products

https://access.redhat.com/errata/RHSA-2026:16483

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-31883 (GCVE-0-2026-31883)

OESA-2026-2039 (CVE-2026-26955)

OESA-2026-2040 (CVE-2026-26955)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour