[oe][meta-oe][wrynose][PATCH 1/15] freerdp3: patch CVE-2026-40254

[oe][meta-oe][wrynose][PATCH 1/15] freerdp3: patch CVE-2026-40254

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commits matching advisory[1] mentioned in the NVD.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40254

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-40254-1.patch   | 46 +++++++++++++++++++
 .../freerdp/freerdp3/CVE-2026-40254-2.patch   | 30 ++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  5 +-
 3 files changed, 80 insertions(+), 1 deletion(-)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch
new file mode 100644
index 0000000000..b758877882
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch
@@ -0,0 +1,46 @@
+From 11b850f6181cb607c7fa4ac7a4fa09d203e0aaf6 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Fri, 10 Apr 2026 08:45:55 +0200
+Subject: [PATCH] [channels,drive] refine bounds checks
+
+* better logging, fix wrong path component printed
+* ensure path does not end with path/..
+
+(cherry picked from commit f502dbb8462597fbe5b97f890359dfdecb525bf7)
+
+CVE: CVE-2026-40254
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/f502dbb8462597fbe5b97f890359dfdecb525bf7]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ channels/drive/client/drive_file.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c
+index 8ea7552a7..3d87d8e6b 100644
+--- a/channels/drive/client/drive_file.c
++++ b/channels/drive/client/drive_file.c
+@@ -113,6 +113,8 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l
+ 				if ((tst[2] == '/') || (tst[2] == '\\'))
+ 					return TRUE;
+ 			}
++			else
++				return TRUE;
+ 		}
+ 		tst += 2;
+ 	} while (TRUE);
+@@ -147,11 +149,10 @@ static WCHAR* drive_file_combine_fullpath(const WCHAR* base_path, const WCHAR* p
+ 		/* Ensure the path does not contain sequences like '..' */
+ 		if (contains_dotdot(&fullpath[base_path_length], base_path_length, PathWCharLength))
+ 		{
+-			char abuffer[MAX_PATH] = WINPR_C_ARRAY_INIT;
+-			(void)ConvertWCharToUtf8(&fullpath[base_path_length], abuffer, ARRAYSIZE(abuffer));
+-
++			char* abuffer = ConvertWCharToUtf8Alloc(&fullpath[base_path_length], nullptr);
+ 			WLog_WARN(TAG, "[rdpdr] received invalid file path '%s' from server, aborting!",
+-			          &abuffer[base_path_length]);
++			          abuffer);
++			free(abuffer);
+ 			goto fail;
+ 		}
+ 	}
diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch
new file mode 100644
index 0000000000..ac727b5235
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch
@@ -0,0 +1,30 @@
+From 3b1f9e5690d60c6a070e40587c5b23e56b172684 Mon Sep 17 00:00:00 2001
+From: Sayed Kaif <metsw24@gmail.com>
+Date: Sun, 28 Jun 2026 16:55:01 +0530
+Subject: [PATCH] [channels,drive] reject trailing '..' in contains_dotdot
+
+The trailing '..' check never fired because PathLength counts the NUL terminator, leaving path_length one WCHAR longer than the string; treat '\0' as a component terminator so a final '..' is rejected like '../'.
+
+(cherry picked from commit 17543c9ae0a72a5413e19741cf0203ab519fb3fd)
+
+CVE: CVE-2026-40254
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/17543c9ae0a72a5413e19741cf0203ab519fb3fd]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ channels/drive/client/drive_file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c
+index 3d87d8e6b..fa93946e2 100644
+--- a/channels/drive/client/drive_file.c
++++ b/channels/drive/client/drive_file.c
+@@ -110,7 +110,7 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l
+ 		{
+ 			if (tst + 2 < path + path_length)
+ 			{
+-				if ((tst[2] == '/') || (tst[2] == '\\'))
++				if ((tst[2] == '/') || (tst[2] == '\\') || (tst[2] == '\0'))
+ 					return TRUE;
+ 			}
+ 			else
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index a4561495cf..7164a81e9d 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -10,7 +10,10 @@ inherit pkgconfig cmake ptest
 
 SRCREV = "3028b706908f81767d9b9c744a90778c28f57d61"
 SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \
-           file://run-ptest"
+           file://run-ptest \
+           file://CVE-2026-40254-1.patch \
+           file://CVE-2026-40254-2.patch \
+"
 
 
 CVE_PRODUCT = "freerdp"

[oe][meta-oe][wrynose][PATCH 2/15] freerdp3: patch CVE-2026-55191

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55191

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55191.patch     | 47 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 48 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch
new file mode 100644
index 0000000000..0881d671bf
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch
@@ -0,0 +1,47 @@
+From 4234cf72c4e9095c163405c4b5c5d41dd4775f81 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:10:58 +0200
+Subject: [PATCH] [codec,h264] fix buffer bounds checks
+
+(cherry picked from commit 97f40b9e766af375f4e41ac6a3f4397d708d249c)
+
+CVE: CVE-2026-55191
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/h264.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c
+index 3b837601c..ce7776b40 100644
+--- a/libfreerdp/codec/h264.c
++++ b/libfreerdp/codec/h264.c
+@@ -495,14 +495,24 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight)
+ 	if (pad != 0)
+ 		padDstHeight += 16 - pad;
+ 
+-	if ((piMainStride[0] != piDstStride[0]) ||
+-	    (piDstSize[0] != 1ull * piMainStride[0] * padDstHeight))
++	if ((piMainStride[0] == 0) || (padDstHeight == 0))
++		return FALSE;
++
++	const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight;
++	if (dstsize > UINT32_MAX)
++		return FALSE;
++
++	if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize))
+ 	{
+ 		for (UINT32 x = 0; x < 3; x++)
+ 		{
+ 			piDstStride[x] = piMainStride[0];
+-			piDstSize[x] = piDstStride[x] * padDstHeight;
+ 
++			const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight;
++			if (dstride > UINT32_MAX)
++				return FALSE;
++
++			piDstSize[x] = WINPR_ASSERTING_INT_CAST(UINT32, dstride);
+ 			if (piDstSize[x] == 0)
+ 				return FALSE;
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 7164a81e9d..e014196f18 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://run-ptest \
            file://CVE-2026-40254-1.patch \
            file://CVE-2026-40254-2.patch \
+           file://CVE-2026-55191.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 3/15] freerdp3: patch CVE-2026-55192

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55192

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55192.patch     | 79 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 80 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch
new file mode 100644
index 0000000000..5cb3fe36d5
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch
@@ -0,0 +1,79 @@
+From 4a8f7a9109a0a2d7c388102d7ad7816d932841c7 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:47:30 +0200
+Subject: [PATCH] [codec,h264] ensure decoded frame size matches expectations
+
+(cherry picked from commit 0cd45b70bb1fe6befd258ff64c46461947e99adb)
+
+CVE: CVE-2026-55192
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/h264_ffmpeg.c     | 4 ++++
+ libfreerdp/codec/h264_mediacodec.c | 5 +++++
+ libfreerdp/codec/h264_mf.c         | 4 ++++
+ libfreerdp/codec/h264_openh264.c   | 4 ++++
+ 4 files changed, 17 insertions(+)
+
+diff --git a/libfreerdp/codec/h264_ffmpeg.c b/libfreerdp/codec/h264_ffmpeg.c
+index 98b8b5e66..5f5e534fa 100644
+--- a/libfreerdp/codec/h264_ffmpeg.c
++++ b/libfreerdp/codec/h264_ffmpeg.c
+@@ -359,6 +359,10 @@ static int libavcodec_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
+ 		iStride[1] = (UINT32)MAX(0, sys->videoFrame->linesize[1]);
+ 		iStride[2] = (UINT32)MAX(0, sys->videoFrame->linesize[2]);
+ 
++		if (sys->videoFrame->width < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
++			goto fail;
++		if (sys->videoFrame->height < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
++			goto fail;
+ 		rc = 1;
+ 	}
+ 	else
+diff --git a/libfreerdp/codec/h264_mediacodec.c b/libfreerdp/codec/h264_mediacodec.c
+index ee84f6b84..9e57969ee 100644
+--- a/libfreerdp/codec/h264_mediacodec.c
++++ b/libfreerdp/codec/h264_mediacodec.c
+@@ -360,6 +360,11 @@ static int mediacodec_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT3
+ 				pYUVData[1] = outputBuffer + iStride[0] * sys->outputHeight;
+ 				pYUVData[2] = outputBuffer + iStride[0] * sys->outputHeight +
+ 				              iStride[1] * ((sys->outputHeight + 1) / 2);
++
++				if (sys->outputWidth < h264->width)
++					goto fail;
++				if (sys->outputHeigth < h264->height)
++					goto fail;
+ 				break;
+ 			}
+ 			else if (outputBufferId == AMEDIACODEC_INFO_OUTPUT_FORMAT_CHANGED)
+diff --git a/libfreerdp/codec/h264_mf.c b/libfreerdp/codec/h264_mf.c
+index ca2eaca68..446f08d5e 100644
+--- a/libfreerdp/codec/h264_mf.c
++++ b/libfreerdp/codec/h264_mf.c
+@@ -370,6 +370,10 @@ static int mf_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT32 SrcSiz
+ 		}
+ 
+ 		outputBuffer->lpVtbl->Release(outputBuffer);
++		if (sys->frameWidth < h264->width)
++			goto error;
++		if (sys->frameHeigth < h264->height)
++			goto error;
+ 	}
+ 
+ 	inputSample->lpVtbl->Release(inputSample);
+diff --git a/libfreerdp/codec/h264_openh264.c b/libfreerdp/codec/h264_openh264.c
+index eb8c71310..f4a7e47f0 100644
+--- a/libfreerdp/codec/h264_openh264.c
++++ b/libfreerdp/codec/h264_openh264.c
+@@ -177,6 +177,10 @@ static int openh264_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
+ 	if (!pYUVData[0] || !pYUVData[1] || !pYUVData[2])
+ 		return -2005;
+ 
++	if (pSystemBuffer->iWidth < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
++		return -2006;
++	if (pSystemBuffer->iHeight < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
++		return -2007;
+ 	return 1;
+ }
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index e014196f18..978f950d8d 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-40254-1.patch \
            file://CVE-2026-40254-2.patch \
            file://CVE-2026-55191.patch \
+           file://CVE-2026-55192.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 4/15] freerdp3: patch CVE-2026-55193

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55193

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55193.patch     | 37 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 38 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch
new file mode 100644
index 0000000000..5fbd142e49
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch
@@ -0,0 +1,37 @@
+From b0b560b3c89e46107092cc8d1abe61ae4c4e7c4d Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:31:09 +0200
+Subject: [PATCH] [core,gateway] rpc header max fragment size checks
+
+(cherry picked from commit a863ef1cf1cdabf9019280e5658f806e73bb50e8)
+
+CVE: CVE-2026-55193
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a863ef1cf1cdabf9019280e5658f806e73bb50e8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/core/gateway/rpc_bind.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/libfreerdp/core/gateway/rpc_bind.c b/libfreerdp/core/gateway/rpc_bind.c
+index cc670d14f..3a055eb50 100644
+--- a/libfreerdp/core/gateway/rpc_bind.c
++++ b/libfreerdp/core/gateway/rpc_bind.c
+@@ -342,6 +342,17 @@ BOOL rpc_recv_bind_ack_pdu(rdpRpc* rpc, wStream* s)
+ 	WLog_DBG(TAG, header.common.ptype == PTYPE_BIND_ACK ? "Receiving BindAck PDU"
+ 	                                                    : "Receiving AlterContextResp PDU");
+ 
++	const UINT16 MAX_VALID_FRAG = 0x0FF8;
++	if ((header.bind_ack.max_xmit_frag > MAX_VALID_FRAG) ||
++	    (header.bind_ack.max_recv_frag > MAX_VALID_FRAG))
++	{
++		WLog_ERR(TAG,
++		         "bind_ack: invalid fragment size: max_xmit_frag=%" PRIu16
++		         ", max_recv_frag=%" PRIu16 ", maximum=%" PRIu16,
++		         header.bind_ack.max_xmit_frag, header.bind_ack.max_recv_frag, MAX_VALID_FRAG);
++		goto fail;
++	}
++
+ 	rpc->max_recv_frag = header.bind_ack.max_xmit_frag;
+ 	rpc->max_xmit_frag = header.bind_ack.max_recv_frag;
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 978f950d8d..4248225379 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -15,6 +15,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-40254-2.patch \
            file://CVE-2026-55191.patch \
            file://CVE-2026-55192.patch \
+           file://CVE-2026-55193.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 5/15] freerdp3: patch CVE-2026-55194

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55194

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55194.patch     | 53 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch
new file mode 100644
index 0000000000..da2733ccf0
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch
@@ -0,0 +1,53 @@
+From 7e828b919a8394abd86a174c4943299618e128eb Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:22:26 +0200
+Subject: [PATCH] [core,gateway] ensure buffer size for current write
+
+(cherry picked from commit 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a)
+
+CVE: CVE-2026-55194
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/core/gateway/rpc_client.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
+index 27f3614f1..59e5781f4 100644
+--- a/libfreerdp/core/gateway/rpc_client.c
++++ b/libfreerdp/core/gateway/rpc_client.c
+@@ -372,7 +372,6 @@ static int rpc_client_recv_pdu(rdpRpc* rpc, RPC_PDU* pdu)
+ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ {
+ 	int rc = -1;
+-	RPC_PDU* pdu = nullptr;
+ 	size_t StubOffset = 0;
+ 	size_t StubLength = 0;
+ 	RpcClientCall* call = nullptr;
+@@ -382,7 +381,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 	WINPR_ASSERT(rpc->client);
+ 	WINPR_ASSERT(fragment);
+ 
+-	pdu = rpc->client->pdu;
++	RPC_PDU* pdu = rpc->client->pdu;
+ 	WINPR_ASSERT(pdu);
+ 
+ 	Stream_SealLength(fragment);
+@@ -464,7 +463,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 		{
+ 			const rpcconn_response_hdr_t* response =
+ 			    (const rpcconn_response_hdr_t*)&header.response;
+-			if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint))
++			if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength))
+ 				goto fail;
+ 
+ 			if (Stream_Length(fragment) < StubOffset + StubLength)
+@@ -472,6 +471,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 
+ 			if (!Stream_SetPosition(fragment, StubOffset))
+ 				goto fail;
++
+ 			Stream_Write(pdu->s, Stream_ConstPointer(fragment), StubLength);
+ 			rpc->StubFragCount++;
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 4248225379..eefc9ab5d3 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55191.patch \
            file://CVE-2026-55192.patch \
            file://CVE-2026-55193.patch \
+           file://CVE-2026-55194.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 6/15] freerdp3: patch CVE-2026-55564

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55564

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55564.patch     | 28 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch
new file mode 100644
index 0000000000..de3674b2c4
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch
@@ -0,0 +1,28 @@
+From 8e1a14795ee8c3aec32c2a9d5b2c6bf00793c92f Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Sat, 13 Jun 2026 21:52:18 +0200
+Subject: [PATCH] [cache,glyph] tighten bounds checks
+
+(cherry picked from commit c29324750e3cbcba8761f147b7a5235cc686930f)
+
+CVE: CVE-2026-55564
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/cache/glyph.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c
+index 374c6151f..8a0d7f64c 100644
+--- a/libfreerdp/cache/glyph.c
++++ b/libfreerdp/cache/glyph.c
+@@ -565,7 +565,7 @@ rdpGlyph* glyph_cache_get(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index)
+ 	}
+ 
+ 	GLYPH_CACHE* cache = &glyphCache->glyphCache[id];
+-	if (index > cache->number)
++	if (index >= cache->number)
+ 	{
+ 		WLog_ERR(TAG, "index %" PRIu32 " out of range for cache id: %" PRIu32 "", index, id);
+ 		return nullptr;
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index eefc9ab5d3..3e891f40d6 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55192.patch \
            file://CVE-2026-55193.patch \
            file://CVE-2026-55194.patch \
+           file://CVE-2026-55564.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 7/15] freerdp3: patch CVE-2026-55648

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55648

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-55648.patch     | 28 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch
new file mode 100644
index 0000000000..ed62b76a94
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch
@@ -0,0 +1,28 @@
+From dbe40963a661a501a227169690c0b3f413514b07 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Sat, 13 Jun 2026 12:14:26 +0200
+Subject: [PATCH] [codec,color] fix source bounds checks
+
+(cherry picked from commit e4ae473da2926724d9b6329778797a3bdea79eb3)
+
+CVE: CVE-2026-55648
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/color.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c
+index 5271cf939..47ef77ab0 100644
+--- a/libfreerdp/codec/color.c
++++ b/libfreerdp/codec/color.c
+@@ -451,7 +451,7 @@ BOOL freerdp_image_copy_from_icon_data(BYTE* WINPR_RESTRICT pDstData, UINT32 Dst
+ 	}
+ 
+ 	/* Ensure we have enough source data bytes for image copy. */
+-	if (cbBitsColor < nWidth * nHeight * FreeRDPGetBytesPerPixel(format))
++	if (cbBitsColor / nHeight < FreeRDPGetBytesPerPixel(format) * nWidth)
+ 	{
+ 		WLog_ERR(TAG,
+ 		         "cbBitsColor{%" PRIu32 "} < nWidth{%" PRIu32 "} * nHeight{%" PRIu32
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 3e891f40d6..4ae18651d4 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55193.patch \
            file://CVE-2026-55194.patch \
            file://CVE-2026-55564.patch \
+           file://CVE-2026-55648.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 8/15] freerdp3: patch CVE-2026-63633

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-63633

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-63633.patch     | 28 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch
new file mode 100644
index 0000000000..478df68d50
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch
@@ -0,0 +1,28 @@
+From 926fef2224e60a3d6eed66198ebc3eb677d63194 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 1 Jul 2026 22:02:25 +0200
+Subject: [PATCH] [codec,dsp] fix opus buffer checks
+
+(cherry picked from commit 0ed1f95d36913581cf31124f94eb5843d4263eae)
+
+CVE: CVE-2026-63633
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/dsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/codec/dsp.c b/libfreerdp/codec/dsp.c
+index b0de39a4c..d07c02635 100644
+--- a/libfreerdp/codec/dsp.c
++++ b/libfreerdp/codec/dsp.c
+@@ -680,7 +680,7 @@ static BOOL freerdp_dsp_decode_opus(FREERDP_DSP_CONTEXT* WINPR_RESTRICT context,
+ 
+ 	/* Max packet duration is 120ms (5760 at 48KHz) */
+ 	const size_t max_size = OPUS_MAX_FRAMES * context->common.format.nChannels * sizeof(int16_t);
+-	if (!Stream_EnsureRemainingCapacity(context->common.buffer, max_size))
++	if (!Stream_EnsureRemainingCapacity(out, max_size))
+ 		return FALSE;
+ 
+ 	const opus_int32 frames =
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 4ae18651d4..054d90718e 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -19,6 +19,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55194.patch \
            file://CVE-2026-55564.patch \
            file://CVE-2026-55648.patch \
+           file://CVE-2026-63633.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 9/15] freerdp3: patch CVE-2026-63652

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-63652

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-63652.patch     | 53 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch
new file mode 100644
index 0000000000..2e77b09d5e
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch
@@ -0,0 +1,53 @@
+From d814e663432dcc8fb485ac91f6106c950d003d9b Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 2 Jul 2026 08:02:29 +0200
+Subject: [PATCH] [channels,rdpsnd] fix free of
+ RdpsndServerContext::client_formats
+
+(cherry picked from commit caf653c0ba1c75ec8f298d1baa59770102a5d14c)
+
+CVE: CVE-2026-63652
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ channels/rdpsnd/server/rdpsnd_main.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/channels/rdpsnd/server/rdpsnd_main.c b/channels/rdpsnd/server/rdpsnd_main.c
+index 8322704ff..29778bb2f 100644
+--- a/channels/rdpsnd/server/rdpsnd_main.c
++++ b/channels/rdpsnd/server/rdpsnd_main.c
+@@ -181,6 +181,14 @@ static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStrea
+ 	return CHANNEL_RC_OK;
+ }
+ 
++static void rdpsnd_server_client_format_free(RdpsndServerContext* context)
++{
++	WINPR_ASSERT(context);
++	free(context->client_formats);
++	context->client_formats = nullptr;
++	context->num_client_formats = 0;
++}
++
+ /**
+  * Read Client Audio Formats and Version PDU (2.2.2.2)
+  *
+@@ -260,7 +268,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
+ 
+ 	return CHANNEL_RC_OK;
+ out_free:
+-	free(context->client_formats);
++	rdpsnd_server_client_format_free(context);
+ 	return error;
+ }
+ 
+@@ -1140,7 +1148,7 @@ void rdpsnd_server_context_free(RdpsndServerContext* context)
+ 	}
+ 
+ 	free(context->server_formats);
+-	free(context->client_formats);
++	rdpsnd_server_client_format_free(context);
+ 	free(context->priv);
+ 	free(context);
+ }
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 054d90718e..86999ffe94 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -20,6 +20,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55564.patch \
            file://CVE-2026-55648.patch \
            file://CVE-2026-63633.patch \
+           file://CVE-2026-63652.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 10/15] freerdp3: patch CVE-2026-64620

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-64620

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-64620.patch     | 37 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 38 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch
new file mode 100644
index 0000000000..e154a92499
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch
@@ -0,0 +1,37 @@
+From c04d10f9586ce92d7a7a3307744e16d554e20cfd Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 2 Jul 2026 08:02:26 +0200
+Subject: [PATCH] [crypto] fix out buffer check
+
+(cherry picked from commit 27014741a8c22a34d3040c559c82f4ed82841bef)
+
+CVE: CVE-2026-64620
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/27014741a8c22a34d3040c559c82f4ed82841bef]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/crypto/crypto.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/libfreerdp/crypto/crypto.c b/libfreerdp/crypto/crypto.c
+index 3d210f2d9..60f7c6cee 100644
+--- a/libfreerdp/crypto/crypto.c
++++ b/libfreerdp/crypto/crypto.c
+@@ -103,11 +103,14 @@ static SSIZE_T crypto_rsa_common(const BYTE* input, size_t length, UINT32 key_le
+ 		goto fail;
+ 	if (BN_mod_exp(y, x, exp, mod, ctx) != 1)
+ 		goto fail;
+-	output_length = BN_bn2bin(y, output);
++	{
++		const int len = BN_num_bytes(y);
++		if ((len < 0) || (WINPR_ASSERTING_INT_CAST(size_t, len) > out_length))
++			goto fail;
++		output_length = BN_bn2bin(y, output);
++	}
+ 	if (output_length < 0)
+ 		goto fail;
+-	if (WINPR_ASSERTING_INT_CAST(size_t, output_length) > out_length)
+-		goto fail;
+ 	crypto_reverse(output, WINPR_ASSERTING_INT_CAST(size_t, output_length));
+ 
+ 	if ((size_t)output_length < key_length)
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 86999ffe94..a577916bef 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55648.patch \
            file://CVE-2026-63633.patch \
            file://CVE-2026-63652.patch \
+           file://CVE-2026-64620.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 11/15] freerdp3: patch CVE-2026-64621

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-64621

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-64621.patch     | 27 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch
new file mode 100644
index 0000000000..4fbc7abf4c
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch
@@ -0,0 +1,27 @@
+From b33dbe41020a6227ad3e89285c27e25e3f8617e9 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 1 Jul 2026 23:03:29 +0200
+Subject: [PATCH] [client,common] fix double free
+
+(cherry picked from commit 7696267929ae8ba045c1bbe275b3915653828313)
+
+CVE: CVE-2026-64621
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/7696267929ae8ba045c1bbe275b3915653828313]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ client/common/file.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/client/common/file.c b/client/common/file.c
+index 9fe207731..1ddf9f0ae 100644
+--- a/client/common/file.c
++++ b/client/common/file.c
+@@ -2533,7 +2533,6 @@ BOOL freerdp_client_populate_settings_from_rdp_file_unchecked(const rdpFile* fil
+ 			if ((val >= UINT32_MAX) && (errno != 0))
+ 			{
+ 				CommandLineParserFree(ptr);
+-				free(list);
+ 				return FALSE;
+ 			}
+ 			list[x] = (UINT32)val;
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index a577916bef..493fa94c4c 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-63633.patch \
            file://CVE-2026-63652.patch \
            file://CVE-2026-64620.patch \
+           file://CVE-2026-64621.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 12/15] freerdp3: patch CVE-2026-66401

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-66401

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-66401.patch     | 86 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 87 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch
new file mode 100644
index 0000000000..480db4836c
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch
@@ -0,0 +1,86 @@
+From 60d0c34ad36ea163b5937d1c9ce657d23dac0f1e Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Sun, 12 Jul 2026 11:45:50 +0200
+Subject: [PATCH] [channels,rdpecam] fix reading of config descriptor
+
+(cherry picked from commit 1d35ecb77e2469cbc29da14c180777eb514d70cd)
+
+CVE: CVE-2026-66401
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/1d35ecb77e2469cbc29da14c180777eb514d70cd]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ channels/rdpecam/client/v4l/uvc_h264.c | 49 +++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 16 deletions(-)
+
+diff --git a/channels/rdpecam/client/v4l/uvc_h264.c b/channels/rdpecam/client/v4l/uvc_h264.c
+index 30f0cf4b4..a3c716478 100644
+--- a/channels/rdpecam/client/v4l/uvc_h264.c
++++ b/channels/rdpecam/client/v4l/uvc_h264.c
+@@ -23,6 +23,8 @@
+  * limitations under the License.
+  */
+ 
++#include <winpr/wtypes.h>
++
+ #include <sys/ioctl.h>
+ 
+ #include <linux/uvcvideo.h>
+@@ -347,26 +349,41 @@ static uint8_t get_guid_unit_id_from_config_descriptor(struct libusb_config_desc
+ 			if (interface->bInterfaceClass != LIBUSB_CLASS_VIDEO ||
+ 			    interface->bInterfaceSubClass != USB_VIDEO_CONTROL)
+ 				continue;
++			if (interface->extra_length < 0)
++				continue;
+ 
+-			const uint8_t* ptr = interface->extra;
+-			while (ptr < interface->extra + interface->extra_length)
++			size_t offset = 0;
++			const size_t extraLen = WINPR_ASSERTING_INT_CAST(size_t, interface->extra_length);
++			while (offset < extraLen)
+ 			{
+-				const xu_descriptor* desc = (const xu_descriptor*)ptr;
+-				if (desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE &&
+-				    desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE &&
+-				    memcmp(desc->guidExtensionCode, guid, 16) == 0)
++				const size_t remaining = extraLen - offset;
++				if (remaining < 3)
++					break;
++				const xu_descriptor* desc = (const xu_descriptor*)&interface->extra[offset];
++
++				WINPR_STATIC_ASSERT(sizeof(xu_descriptor) == 16 + 4);
++				const size_t bLength = WINPR_ASSERTING_INT_CAST(size_t, desc->bLength);
++				if ((desc->bLength <= 0) || (bLength > remaining))
++					break;
++
++				if ((desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE) &&
++				    (desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE) &&
++				    (bLength >= sizeof(xu_descriptor)))
+ 				{
+-					int8_t unit_id = desc->bUnitID;
+-
+-					WLog_DBG(TAG,
+-					         "For camera %04" PRIx16 ":%04" PRIx16
+-					         " found UVCX H264 UnitID %" PRId8,
+-					         ddesc->idVendor, ddesc->idProduct, unit_id);
+-					if (unit_id < 0)
+-						return 0;
+-					return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id);
++					if (memcmp(desc->guidExtensionCode, guid, 16) == 0)
++					{
++						int8_t unit_id = desc->bUnitID;
++
++						WLog_DBG(TAG,
++						         "For camera %04" PRIx16 ":%04" PRIx16
++						         " found UVCX H264 UnitID %" PRId8,
++						         ddesc->idVendor, ddesc->idProduct, unit_id);
++						if (unit_id < 0)
++							return 0;
++						return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id);
++					}
+ 				}
+-				ptr += desc->bLength;
++				offset += bLength;
+ 			}
+ 		}
+ 	}
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 493fa94c4c..7051cbeacc 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -23,6 +23,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-63652.patch \
            file://CVE-2026-64620.patch \
            file://CVE-2026-64621.patch \
+           file://CVE-2026-66401.patch \
 "
 
 

[oe][meta-oe][wrynose][PATCH 13/15] freerdp3: patch CVE-2026-67288

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit matching GitHub advisory[1] also identified by Debian[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-67288

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3
[2]https://security-tracker.debian.org/tracker/CVE-2026-67288

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-67288.patch     | 69 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 70 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch
new file mode 100644
index 0000000000..9be89cf276
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch
@@ -0,0 +1,69 @@
+From 833cb82a82ff59d916c86ae1ac90b84bf8e86c47 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 9 Jul 2026 08:34:21 +0200
+Subject: [PATCH] [scard] handle nullptr for LookupName
+
+(cherry picked from commit efe40e15d508f9754b7a3af851de4d2a0b1128d8)
+
+CVE: CVE-2026-67288
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/emu/scard/smartcard_emulate.c  | 7 ++++---
+ winpr/libwinpr/smartcard/smartcard_pcsc.c | 9 +++++----
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/libfreerdp/emu/scard/smartcard_emulate.c b/libfreerdp/emu/scard/smartcard_emulate.c
+index 0be4c4c5d..25e0ee179 100644
+--- a/libfreerdp/emu/scard/smartcard_emulate.c
++++ b/libfreerdp/emu/scard/smartcard_emulate.c
+@@ -46,8 +46,8 @@ static size_t g_ReaderNameWLen = 0;
+ 
+ static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
+ {
+-	WINPR_ASSERT(CardIdentifier);
+-	WINPR_ASSERT(LookupName);
++	if (!CardIdentifier || !LookupName)
++		return nullptr;
+ 
+ 	size_t len = strlen(LookupName) + 34;
+ 	char* id = malloc(len);
+@@ -2264,7 +2264,8 @@ LONG WINAPI Emulate_SCardReadCacheA(SmartcardEmulationContext* smartcard, SCARDC
+ 		WINPR_ASSERT(value); /* Must be valid after Emulate_SCardIsValidContext */
+ 
+ 		char* id = card_id_and_name_a(CardIdentifier, LookupName);
+-		data = HashTable_GetItemValue(value->cache, id);
++		if (id)
++			data = HashTable_GetItemValue(value->cache, id);
+ 		free(id);
+ 
+ 		if (!data)
+diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c
+index b5cf85e23..58bea94f1 100644
+--- a/winpr/libwinpr/smartcard/smartcard_pcsc.c
++++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c
+@@ -2951,8 +2951,8 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardDlgExtendedError(void)
+ WINPR_ATTR_NODISCARD
+ static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
+ {
+-	WINPR_ASSERT(CardIdentifier);
+-	WINPR_ASSERT(LookupName);
++	if (!CardIdentifier || !LookupName)
++		return nullptr;
+ 
+ 	size_t len = strlen(LookupName) + 34;
+ 	char* id = malloc(len);
+@@ -2991,9 +2991,10 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hConte
+ 		return SCARD_E_INVALID_HANDLE;
+ 
+ 	char* id = card_id_and_name_a(CardIdentifier, LookupName);
+-
+-	data = HashTable_GetItemValue(ctx->cache, id);
++	if (id)
++		data = HashTable_GetItemValue(ctx->cache, id);
+ 	free(id);
++
+ 	if (!data)
+ 	{
+ 		*DataLen = 0;
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 7051cbeacc..edd2fddf94 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -24,6 +24,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-64620.patch \
            file://CVE-2026-64621.patch \
            file://CVE-2026-66401.patch \
+           file://CVE-2026-67288.patch \
 "
 
 

[oe][meta-python][wrynose][PATCH 14/15] python3-gunicorn: mark CVE-2024-1135 patched

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb
index cf41feae70..90a903ea53 100644
--- a/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb
+++ b/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb
@@ -29,3 +29,5 @@ do_install_ptest() {
 }
 
 RDEPENDS:${PN} += "python3-setuptools python3-fcntl"
+
+CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0"

[oe][meta-python][wrynose][PATCH 15/15] python3-h11: mark CVE-2025-43859 patched

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-43859

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-python/recipes-devtools/python/python3-h11_0.16.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
index ed1702ff54..0bc1cd5c41 100644
--- a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
+++ b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
@@ -10,3 +10,5 @@ SRC_URI[sha256sum] = "4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208
 CVE_PRODUCT = "python-hyper:h11"
 
 RDEPENDS:${PN} += "python3-profile"
+
+CVE_STATUS[CVE-2025-43859] = "fixed-version: fixed in v0.16.0"