Security Vulnerabilities
FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.
CVSS Score
8.7
EPSS Score
0.004
Published
2026-11-04
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
CVSS Score
9.3
EPSS Score
0.005
Published
2026-11-04
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
CVSS Score
9.3
EPSS Score
0.006
Published
2026-11-04
FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client.
CVSS Score
7.1
EPSS Score
0.004
Published
2026-11-04
Tanium addressed an information disclosure vulnerability in Discover.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-11-03
Tanium addressed an improper access controls vulnerability in Discover.
CVSS Score
4.2
EPSS Score
0.001
Published
2026-11-03
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
CVSS Score
4.3
EPSS Score
0.003
Published
2026-11-03
Tanium addressed an improper access controls vulnerability in Discover.
CVSS Score
6.5
EPSS Score
0.002
Published
2026-11-03
Tanium addressed an improper access controls vulnerability in Discover.
CVSS Score
3.1
EPSS Score
0.002
Published
2026-11-03
Tanium addressed an information disclosure vulnerability in Discover.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-11-03