On Mon, Feb 09, 2026 at 03:31:46PM -0800, Alan Coopersmith wrote: > > - @Keryer reported an issue affecting client and proxy: > > CVE-2026-23948 > > - @ehdgks0627 did some more fuzzying and found quite a number of > client > > side bugs. > > CVE-2026-24682 > > CVE-2026-24683 > > CVE-2026-24676 > > CVE-2026-24677 > > CVE-2026-24678 > > CVE-2026-24684 > > CVE-2026-24679 > > CVE-2026-24681 > > CVE-2026-24675 > > CVE-2026-24491 > > CVE-2026-24680 > > More details on each of these are available at:
> - CVE-2026-24682 Heap-buffer-overflow in audio_formats_free > https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcw2-pqgw-mx6g > - CVE-2026-24677 Heap-buffer-overflow in ecam_encoder_compress_h264 > https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xw37-j744-f8v7 > - CVE-2026-24679 Heap-buffer-overflow in urb_select_interface > https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x All 3 of these "Heap-buffer-overflow" issues are actually out of bounds reads, per ASan. It's another case of ASan mislabeling this, and people blindly copying what it says into advisories and CVE titles. It can't be ruled out (without code review) that if the out of bounds reads did not terminate processing, some of them could possibly be followed by out of bounds writes. However, ASan is currently unable to find this. I wonder if besides correcting the string "Heap-buffer-overflow" ASan could reasonably be enhanced not to terminate the task on out of bounds reads, so that it would also have a chance to detect subsequent writes. Alexander
