CVE-2026-23530: Freerdp Received Capabilities Desync Resizecve-2026-23530-freerdp-received-capabilities-desync-resize
Resizing a single capability buffer (FreeRDP_ReceivedCapabilityData / FreeRDP_ReceivedCapabilities / FreeRDP_ReceivedCapabilityDataSizes) via freerdp_settings_set_pointer_len_ while bumping the shared FreeRDP_ReceivedCapabilitiesSize tracker leaves the three logically parallel arrays out of sync. Later code iterates all of them up to ReceivedCapabilitiesSize