IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2026-121408FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel

FreeRDP FreeRDP Yayım: (8 gün önce)

Açıklama

FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.

Zayıflık türü (CWE): CWE-362

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
FreeRDP FreeRDP < 3.32.2, fixed 3.32.2

Ubuntu düzeltmeleri

  • USN-9007-1 FreeRDP vulnerabilities Ubuntu 26.10, 26.04, 24.04 · 09.11.2026 · freerdp3

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* < 3.32.2

Aynı üründe son açıklar — Ubuntu 24.04 LTS

7.7Yüksek
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…