Security Vulnerabilities
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
CVSS Score
9.8
EPSS Score
0.01
Published
2026-10-13
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Known exploited
CVSS Score
8.6
EPSS Score
0.26
Published
2026-10-13
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.
CVSS Score
6.0
EPSS Score
0.002
Published
2026-10-13
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcard_pack_transmit_return to serialize up to 66,560 uninitialized heap bytes.
CVSS Score
5.3
EPSS Score
0.002
Published
2026-10-13
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-10-13
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
CVSS Score
5.3
EPSS Score
0.003
Published
2026-10-13
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.
CVSS Score
6.9
EPSS Score
0.003
Published
2026-10-13