huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-31581: kernel: ALSA: 6fire: fix use-after-free on disconnect
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory corruption and potentially cause system instability or a denial of service.

Statement: The 6fire USB audio disconnect path could touch freed memory; upstream hardens teardown ordering. Red Hat customers using this rare interface should update kernels. Optional mitigation is unloading the 6fire ALSA USB driver module where unused.

Affected upstream versions: 5.10.231 < 5.10.258, 5.15.174 < 5.15.209, 6.1.120 < 6.1.175, 6.6.64 < 6.6.136, 6.12.2 < 6.12.83, 4.19.325 < 4.20, 5.4.287 < 5.5, 6.11.11 < 6.12, 6.13
Fixed upstream versions: 0, 4.20, 5.10.258, 5.15.209, 5.5, 6.1.175, 6.12, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0.1, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e719232f4552e29de8027a83918ea94434be87af
CVE-2026-31607: kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()
Component: kernel
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system.


Affected upstream versions: 2.6.32.37 < 2.6.33, 2.6.33.10 < 2.6.34, 2.6.34.11 < 2.6.35, 2.6.35.13 < 2.6.36, 2.6.38.3 < 2.6.39, 2.6.39
Fixed upstream versions: 0, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.39, 5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0.1, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 324262c38438255bf6bdbf6342ca47c0badaab76
CVE-2026-31613: kernel: smb: client: fix OOB reads parsing symlink error response
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a local user through the readlink(2) system call.


Affected upstream versions: 6.0.16 < 6.1, 6.1
Fixed upstream versions: 0, 6.1, 6.1.175, 6.12.91, 6.18.24, 6.19.14, 6.6.141, 7.0.1, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 043834e72337ee7b4e9685859888623ba1504ac7
CVE-2026-31636: kernel: rxrpc: fix RESPONSE authenticator parser OOB read
Component: kernel
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could send a specially crafted rxrpc RESPONSE authenticator that, due to an incorrect parser limit calculation in the rxgk_verify_authenticator() function, leads to a slab-out-of-bounds read. This memory corruption vulnerability could result in information disclosure or a denial of service.


Affected upstream versions: 6.16
Fixed upstream versions: 0, 6.18.23, 6.19.13, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7875f3d9777bd4e9892c4db830571ab8ac2044c0
CVE-2026-31641: kernel: rxrpc: Fix RxGK token loading to check bounds
Component: kernel
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the `rxrpc_preparse_xdr_yfs_rxgk()` function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size. Consequently, a heap buffer overflow can occur, potentially leading to arbitrary code execution or a denial of service.


Affected upstream versions: 6.16
Fixed upstream versions: 0, 6.18.23, 6.19.13, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3e04596cba8a86cbff9c3f4bf0a524a3a488773c
CVE-2026-31669: kernel: mptcp: fix slab-use-after-free in __inet_lookup_established
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-24T00:00:00+00:00

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. Due to incorrect memory allocation for IPv6 subflow child sockets, a use-after-free vulnerability exists. A remote attacker could exploit this by triggering concurrent lookups in the kernel's hash table, potentially leading to a denial of service or arbitrary code execution.

Statement: A slab use after free can occur in the MPTCP IPv6 subflow path because tcpv6_prot_override may end up with a NULL slab cache pointer and child sockets are then allocated from a non RCU safe kmalloc cache. Lockless ehash lookups rely on SLAB_TYPESAFE_BY_RCU for socket memory stability under rcu_read_lock. When the affected sockets are freed without SOCK_RCU_FREE the memory can be reused immediately and a concurrent __inet_lookup_established lookup can access freed memory. This is at least a denial of service via kernel crash and it is a memory corruption class issue that may allow confidentiality or integrity impact in a worst case scenario. The issue can be network reachable via MPTCP over IPv6, but there is no known attack scenario for now. There is no confirmed practical trigger scenario under default configurations. It appears to require specific non-default preconditions (MPTCP/IPv6 runtime conditions and vulnerable child socket creation paths) that are not known to be reachable by default, so this is the reason to keep this one "Moderate" impact level.

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.203, 6.1.169, 6.12.82, 6.18.23, 6.19.13, 6.6.135, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47
CVE-2026-31677: kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget
Component: kernel
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-25T00:00:00+00:00

A flaw was found in the Linux kernel's `af_alg` (Algorithm Interface) component. This vulnerability allows a local attacker to cause a denial of service (DoS) by sending specially crafted requests. The `af_alg_get_rsgl()` function fails to properly limit the extraction of receive scatterlist (RX SG) data based on the available receive buffer, leading to the rejection of `recvmsg` calls and preventing further data processing.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 6.12.83, 6.18.24, 6.19.14, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9
CVE-2026-31684: kernel: net: sched: act_csum: validate nested VLAN headers
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-25T00:00:00+00:00

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network (VLAN) headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of service.


Affected upstream versions: 4.19.99 < 4.20, 5.1
Fixed upstream versions: 0, 4.20, 5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0410c619e86551677fb79887a38eccad3f5a0725
CVE-2026-31685: kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets
Component: kernel
Severity: Moderate
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-25T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because the `eui64_mt6()` function, which processes IPv6 packets, does not properly validate the MAC header for all packets. Specifically, packets with a zero fragment offset could bypass an existing guard, allowing the system to attempt to access an invalid MAC header. A remote attacker could exploit this by sending specially crafted IPv6 packets, potentially causing a system crash and leading to a Denial of Service (DoS).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4d75bc2cd093bf5803edf512c099bfb220fd6459
CVE-2026-31692: kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns
Component: kernel
Severity: Moderate
CWE: CWE-272 (Least Privilege Violation)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-30T00:00:00+00:00

A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing `CAP_NET_ADMIN` capability check in the `rtnl_newlink()` function. This allows the user to create paired network devices in arbitrary network namespaces, including the `init_net` (initial network namespace). Such unauthorized creation of network interfaces could lead to unexpected network configurations and potential system instability or resource exhaustion.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 6.18.24, 6.19.14, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0975b64ffb34560042090a5986c3a02e6c80f36f
CVE-2026-31709: kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
Component: kernel
Severity: Important
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.210, 6.1.176, 6.12.86, 6.18.35, 6.6.140, 7.0.2, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8603d9ae6c9087662b098619996bc4a8064319d
CVE-2026-31772: kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) synchronization. A local user could trigger a stack buffer overflow by binding a specific type of Bluetooth socket with an excessive number of Bluetooth Isochronous Stream (BIS) entries. This memory corruption can lead to a system crash, resulting in a denial of service.


Affected upstream versions: 6.12.2 < 6.12.81, 6.11.11 < 6.12, 6.13
Fixed upstream versions: 0, 6.12, 6.12.81, 6.18.22, 6.19.12, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f5d446624345d309e7a4a1b27ea9f028d6a8c5d9
CVE-2026-31786: kernel: Buffer overflow in drivers/xen/sys-hypervisor.c
Component: kernel
Severity: Moderate
CWE: CWE-170 (Improper Null Termination)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-30T00:00:00+00:00

A flaw was found in the Linux kernel. A buffer overflow vulnerability exists in the Xen hypervisor driver (`drivers/xen/sys-hypervisor.c`). This flaw occurs because the `HYPERVISOR_xen_version(XENVER_build_id)` function returns a build ID that is not properly null-terminated. When the `buildid_show` function attempts to process this non-null-terminated string using `sprintf`, it can read and copy beyond the intended buffer boundary, potentially leading to a denial of service or other unspecified impacts.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 5.10.254, 5.15.204, 6.1.170, 6.12.85, 6.18.26, 6.6.137, 7.0.3, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e3af585e1728c917682b6a3de9a69b41fb9194d4
CVE-2026-31787: kernel: xen/privcmd: fix double free via VMA splitting
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-04-30T00:00:00+00:00

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a `privcmd` memory region. This action causes a Virtual Memory Area (VMA) to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed twice, a condition known as a double free, which can cause system instability or a denial of service.


Affected upstream versions: 3.8
Fixed upstream versions: 0, 5.10.254, 5.15.204, 6.1.170, 6.12.85, 6.18.26, 6.6.137, 7.0.3, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dbf862ce9f009128ab86b234d91413a3e450beb4
CVE-2026-31789: openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment.

Statement: This issue has a Low impact. The vulnerability affects 32-bit systems and requires an application or service to process an unusually large X.509 certificate (over 1 Gigabyte) by printing or logging its contents. This specific condition makes exploitation unlikely in typical Red Hat environments.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20
Fixed upstream versions: 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: a24216018e1ede8ff01a4ff5afff7dfbd443e2f9
CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key
Component: openssl
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.

Statement: Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20
Fixed upstream versions: 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: abd8b2eec7e3f3fda60ecfb68498b246b52af482
CVE-2026-31802: tar: tar: File overwrite via drive-relative symlink traversal
Component: tar
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-03-09T21:11:56.668000+00:00

A flaw was found in tar. An attacker can exploit this vulnerability by crafting a malicious tar archive containing a drive-relative symlink. This symlink, such as C:../../../target.txt, can trick the tar utility into writing files outside the intended extraction directory during normal archive extraction, leading to unauthorized file overwrite.

Statement: This is a MODERATE impact vulnerability. The tar utility is susceptible to unauthorized file overwrites when processing specially crafted archives containing drive-relative symlinks. As such, it primarily affects integrity (since it can overwrite files and file contents), with no clear indication that availability or confidentiality may be affected.

Affected upstream versions: < 7.5.11
Fixed upstream versions: v7.5.11
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad
CVE-2026-31806: freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
Component: freerdp
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T17:40:19.920000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The `gdi_surface_bits()` function, which processes `SURFACE_BITS_COMMAND` messages, does not properly validate image dimensions (`bmp.width` and `bmp.height`) provided by a malicious RDP server. This can lead to a heap buffer overflow during bitmap decoding and memory operations. A remote attacker could exploit this to overwrite adjacent memory, potentially resulting in arbitrary code execution.

Statement: For this vulnerability to be exploited, a susceptible system must connect to a malicious server. For that reason, Red Hat recommends that you only use FreeRDP to connect to trusted servers.

Affected upstream versions: < 3.24.0
Fixed upstream versions: 3.24.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 83d9aedea278a74af3e490ff5eeb889c016dbb2b
CVE-2026-31883: freerdp: FreeRDP: Denial of Service via crafted audio data in RDP
Component: freerdp
Severity: Moderate
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-03-13T17:35:17.411000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A remote attacker can exploit a size_t underflow vulnerability in the IMA-ADPCM and MS-ADPCM audio decoders by sending specially crafted audio data over the RDPSND audio channel. This underflow leads to a heap-buffer-overflow write, which can result in a denial of service for the FreeRDP client.

Statement: Red Hat has protection mechanisms in place, such as FORTIFY_SOURCE, Position Independent Executables or Stack Smashing Protection.

Affected upstream versions: < 3.24.0
Fixed upstream versions: 3.24.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 16df2300e1e3f5a51f68fb1626429e58b531b7c8
CVE-2026-31884: freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
Component: freerdp
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-03-13T17:36:57.722000+00:00

A division by zero flaw has been discovered in FreeRDP. This division by zero exists in the MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash.


Affected upstream versions: < 3.24.0
Fixed upstream versions: 3.24.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 03b48b3601d867afccac1cdc6081de7a275edce7
CVE-2026-31885: freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2026-03-13T17:38:23.756000+00:00

An out of bounds read flaw has been discovered in FreeRDP. This out-of-bounds read exists in the MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. An attacker may be able to leverage this weakness to leak global data.


Affected upstream versions: < 3.24.0
Fixed upstream versions: 3.24.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 16df2300e1e3f5a51f68fb1626429e58b531b7c8
CVE-2026-31898: jspdf: jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method
Component: jspdf
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2026-03-18T03:03:43.469000+00:00

A flaw was found in jsPDF, a JavaScript library used for generating PDF documents. This vulnerability allows a remote attacker to inject arbitrary PDF objects, including JavaScript actions, into a generated PDF. This can occur if unsanitized user input is provided to the `createAnnotation` method's `color` parameter. When a user opens or interacts with the specially crafted PDF, these injected actions may execute, potentially leading to arbitrary code execution or sensitive information disclosure.


Affected upstream versions: < 4.2.1
Fixed upstream versions: v4.2.1
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 4155c4819d5eca284168e51e0e1e81126b4f14b8