CVE-2026-2048
published 2026-02-20CVE-2026-2048: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected…
PriorityP345high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.62%
46.2th percentile
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u9 (bookworm) | gimp 2.10.34-1+deb12u9 (bookworm) |
| elysiajs | elysia | >= 0 < 1.4.26 | 1.4.26 |
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u7 | 2.10.22-4+deb11u7 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u9 | 2.10.34-1+deb12u9 |
| gimp | gimp | >= 0 < 3.0.4-3+deb13u7 | 3.0.4-3+deb13u7 |
| gimp | gimp | >= 0 < 3.2.0~RC3-1 | 3.2.0~RC3-1 |
| linux | linux_kernel | >= 3.2.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_redhat9.8CRITICAL
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nfc: nci: complete pending data exchange on device close
osv·2026-03-25
CVE-2026-23330 nfc: nci: complete pending data exchange on device close
nfc: nci: complete pending data exchange on device close
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: complete pending data exchange on device close
In nci_close_device(), complete any pending data exchange before
closing. The data exchange callback (e.g.
rawsock_data_exchange_complete) holds a socket reference.
NIPA occasionally hits this leak:
unreferenced object 0xff1100000f435000 (size 2048):
comm "nci_dev", pid 3954, jiffies 4295441245
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc ec2b3c5):
__kmalloc_noprof+0x4db/0x730
sk_prot_alloc.isra.0+0xe4/0x1d0
sk_alloc+0x36/0x760
rawsock_create+0xd1/0x540
nfc_sock_create+0x11f/0x280
GHSA
Elysia has a string URL format ReDoS
ghsa·2026-03-10
CVE-2026-30837 [HIGH] CWE-1333 Elysia has a string URL format ReDoS
Elysia has a string URL format ReDoS
### Impact
`t.String({ format: 'url' })` is vulnerable to redos
Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly
```js
'http://a'.repeat(n)
```
Here's a table demonstrating how long it takes to process repeated partial url format
| `n` repeat | elapsed_ms |
| --- | --- |
| 1024 | 33.993 |
| 2048 | 134.357 |
| 4096 | 537.608 |
| 8192 | 2155.842 |
| 16384 | 8618.457 |
| 32768 | 34604.139 |
### Patches
Patched by 1.4.26, please kindly update `elysia` to >= 1.4.26
Here's how long it takes after the patch
| `n` repeat | elapsed_ms |
| --- | --- |
| 1024 | 0.194 |
| 2048 | 0.274 |
| 4096 | 0.455 |
| 8192 | 0.831 |
| 16384 | 1.632 |
| 32768 | 3.052 |
### Workarounds
1. It's recommended to always
GHSA
GHSA-974r-v62q-8fqc: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
ghsa_unreviewed·2026-02-21
CVE-2026-2048 [HIGH] CWE-787 GHSA-974r-v62q-8fqc: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
OSV
CVE-2026-2048: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
osv·2026-02-20·CVSS 7.8
CVE-2026-2048 [HIGH] CVE-2026-2048: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
Red Hat
kernel: hwmon: (pmbus/adm1266) reject implausible blackbox record_count
vendor_redhat·2026-07-19
CVE-2026-64087 CWE-125 kernel: hwmon: (pmbus/adm1266) reject implausible blackbox record_count
kernel: hwmon: (pmbus/adm1266) reject implausible blackbox record_count
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject implausible blackbox record_count
adm1266_nvmem_read_blackbox() loops over a record_count that comes
straight from byte 3 of the BLACKBOX_INFO response. The destination
buffer is data->dev_mem, sized for the nvmem cell's declared 2048
bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64).
A device that reports a record_count greater than 32 -- whether due
to firmware bugs, bus corruption, or a non-responsive slave returning
0xff -- would walk read_buff past the end of the dev_mem allocation
on the trailing iterations.
Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here)
before entering the l
Red Hat
gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
vendor_redhat·2026-07-08·CVSS 7.5
CVE-2026-59692 [HIGH] CWE-121 gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
Statement: This vulnerability is rated as Important severity because it is remotely triggerable without authentication or user interaction during a DTLS handshake. However, the actual impact is limited to denial of service. Remote code execution is not achievable because X509_NA
Red Hat
gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
vendor_redhat·2026-02-20·CVSS 7.8
CVE-2026-2048 [HIGH] CWE-787 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
A flaw was found in GIMP. A remote attacker can exploit this out-of-bounds write vulnerability by
Debian
CVE-2026-2048: gimp - GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T...
vendor_debian·2026·CVSS 7.8
CVE-2026-2048 [HIGH] CVE-2026-2048: gimp - GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T...
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u9)
bullseye: resolved (fixed in 2.10.22-4+deb11u7)
forky: resolved (fixed in 3.2.0~RC3-1)
sid: resolved (fixed
No detection rules found.
Nuclei
Mailpit < 1.28.2 - SMTP CRLF Injection
nuclei·CVSS 5.3
CVE-2026-23829 [MEDIUM] Mailpit < 1.28.2 - SMTP CRLF Injection
Mailpit \r\n"
- data: "RCPT TO:\r\n"
- data: "DATA\r\n"
- data: "Subject: Test \r\n\r\nCombined Template Check.\r\n.\r\n"
- data: "QUIT\r\n"
host:
- "{{Hostname}}"
port: 1025
read-size: 2048
matchers-condition: and
matchers:
- type: word
words:
- "250"
- type: word
words:
- "501"
- "500"
- "553"
negative: true
# digest: 4a0a0047304502200f570bfab50462345a827ffa87477fb6fc5225dcf15268a8f4a2a111cb416842022100f187296c379c50875abba89d7ec0e3d605262c0bfe52fafc20efca7730622d80:922c64590222798bb761d5b6d8e72950
Bugzilla
CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [epel-all]
bugzilla·2026-07-21·CVSS 9.8
CVE-2026-64620 [CRITICAL] CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [epel-all]
CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap b
Bugzilla
CVE-2026-64620 freerdp: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
bugzilla·2026-07-21·CVSS 9.8
CVE-2026-64620 [CRITICAL] CVE-2026-64620 freerdp: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
CVE-2026-64620 freerdp: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap
Bugzilla
CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
bugzilla·2026-07-21·CVSS 9.8
CVE-2026-64620 [CRITICAL] CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
CVE-2026-64620 freerdp2: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap
Bugzilla
CVE-2026-29009 uboot-tools: U-Boot: Memory corruption via NFS readlink buffer overflow [epel-all]
bugzilla·2026-07-13·CVSS 8.2
CVE-2026-29009 [HIGH] CVE-2026-29009 uboot-tools: U-Boot: Memory corruption via NFS readlink buffer overflow [epel-all]
CVE-2026-29009 uboot-tools: U-Boot: Memory corruption via NFS readlink buffer overflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjace
Bugzilla
CVE-2026-29009 u-boot: U-Boot: Memory corruption via NFS readlink buffer overflow
bugzilla·2026-07-08·CVSS 8.2
CVE-2026-29009 [HIGH] CVE-2026-29009 u-boot: U-Boot: Memory corruption via NFS readlink buffer overflow
CVE-2026-29009 u-boot: U-Boot: Memory corruption via NFS readlink buffer overflow
U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
Bugzilla
CVE-2026-59692 gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
bugzilla·2026-07-06·CVSS 7.5
CVE-2026-59692 [HIGH] CVE-2026-59692 gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
CVE-2026-59692 gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
A stack buffer overflow was found in GStreamer's DTLS plugin (gst-plugins-bad). In openssl_verify_callback(), the peer certificate Subject DN is printed using X509_NAME_print_ex() into a memory BIO, then read via BIO_read() into a fixed gchar buf[2048] on the stack. The number of bytes read comes directly from the X509_NAME_print_ex() return value without bounds checking against the buffer size.
A remote DTLS peer can send a certificate with an oversized Subject DN (many long OU fields) so that the formatted output exceeds 2048 bytes, causing a stack buffer overflow during the DTLS handshake.
File: subprojects/gst-plugins-bad/ext/dtls/gstdtlsconnection.c
Function: openssl_ve
Bugzilla
CVE-2026-53143 kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
bugzilla·2026-06-25
CVE-2026-53143 [HIGH] CVE-2026-53143 kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
CVE-2026-53143 kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
The v11 MQD manager incorrectly assigned the CP-compute variants of
checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions
use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct
v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.
During CRIU checkpoint of an SDMA queue on Navi3x:
- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,
leaking 1536 bytes of adjacent GTT memory to userspace
During CRIU restore:
- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,
corrupting 1536 bytes
Bugzilla
CVE-2026-49943 bird: BIRD Internet Routing Daemon: Denial of Service via stack-based buffer overflow in BGP AS_PATH processing
bugzilla·2026-06-02·CVSS 6.3
CVE-2026-49943 [MEDIUM] CVE-2026-49943 bird: BIRD Internet Routing Daemon: Denial of Service via stack-based buffer overflow in BGP AS_PATH processing
CVE-2026-49943 bird: BIRD Internet Routing Daemon: Denial of Service via stack-based buffer overflow in BGP AS_PATH processing
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp_path ~ [= ... =]", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, res
Bugzilla
CVE-2026-46175 kernel: f2fs: fix fsck inconsistency caused by FGGC of node block
bugzilla·2026-05-28
CVE-2026-46175 CVE-2026-46175 kernel: f2fs: fix fsck inconsistency caused by FGGC of node block
CVE-2026-46175 kernel: f2fs: fix fsck inconsistency caused by FGGC of node block
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by FGGC of node block
During FGGC node block migration, fsck may incorrectly treat the
migrated node block as fsync-written data.
The reproduction scenario:
root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync
root@vm:/mnt/f2fs# rm -f 1
root@vm:/mnt/f2fs# sync
root@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP
SPO, "fsck --dry-run" find inode has already checkpointed but still
with DENT_BIT_SHIFT set
The root cause is that GC does not clear the dentry mark and fsync mark
during node block migration, leading fsck to misinterpret them as
u
Bugzilla
CVE-2026-2048 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
bugzilla·2026-02-20·CVSS 7.8
CVE-2026-2048 [HIGH] CVE-2026-2048 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
CVE-2026-2048 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
Discussion:
This issue has been addressed in the following products:
Red Hat Ent
Bugzilla
CVE-2026-23530 freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server.
bugzilla·2026-01-19·CVSS 7.7
CVE-2026-23530 [HIGH] CVE-2026-23530 freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server.
CVE-2026-23530 freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:2048 https://access.redhat.com/errata/RHSA-2026:2048
---
This issue h
Bugzilla
CVE-2026-23883 freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server
bugzilla·2026-01-19·CVSS 7.7
CVE-2026-23883 [HIGH] CVE-2026-23883 freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server
CVE-2026-23883 freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:2048 https://access.redhat.com/errata/RHSA-2026:2048
---
This issue has been addressed in the following product
Bugzilla
CVE-2026-23532 freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow
bugzilla·2026-01-19·CVSS 7.7
CVE-2026-23532 [HIGH] CVE-2026-23532 freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow
CVE-2026-23532 freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:2048 https://access.redhat.com/errata/RHSA-2026:2
Wiz
CVE-2026-2048 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-2048 [HIGH] CVE-2026-2048 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2048 :
NixOS vulnerability analysis and mitigation
GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.
Source : NVD
## 7.8
Score
Published February 20, 2026
Severity HIGH
CNA Score 7.8
Affected Te
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2586/diffs?commit_id=57712677007793118388c5be6fb8231f22a2b341https://www.zerodayinitiative.com/advisories/ZDI-26-121/https://access.redhat.com/errata/RHSA-2026:4173https://access.redhat.com/errata/RHSA-2026:5113https://access.redhat.com/errata/RHSA-2026:5388https://access.redhat.com/errata/RHSA-2026:5389https://access.redhat.com/errata/RHSA-2026:5390https://access.redhat.com/errata/RHSA-2026:5391https://access.redhat.com/errata/RHSA-2026:5434https://access.redhat.com/errata/RHSA-2026:5435https://access.redhat.com/errata/RHSA-2026:5436https://access.redhat.com/errata/RHSA-2026:5437https://access.redhat.com/security/cve/CVE-2026-2048https://bugzilla.redhat.com/show_bug.cgi?id=2441527https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2048.json
2026-02-20
Published