CVE-2026-22852: Freerdp Audin Formats Realloc Without Reset
Reassignment of an AUDIO_FORMAT array via audio_formats_new() without first freeing the previous array (audio_formats_free) and resetting the associated formats_count counter to zero. Repeated execution (for example, multiple MSG_SNDIN_FORMATS PDUs from a remote server) causes the stale counter to drive writes past the end of the newly allocated array (CVE-2
Cgreprules fetch cve-2026-22852-freerdp-audin-formats-realloc-without-reset --engine opengrepDescription
Reassignment of an AUDIO_FORMAT array via audio_formats_new() without first freeing the previous array (audio_formats_free) and resetting the associated formats_count counter to zero. Repeated execution (for example, multiple MSG_SNDIN_FORMATS PDUs from a remote server) causes the stale counter to drive writes past the end of the newly allocated array (CVE-2
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.