← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-xxpf-vhg6-6873: Missing SPS NAL Unit Bounds Check in webcodecs_decompress() & Zero-Length NAL Termination in next_nal() (FreeRDP/FreeRDP)

[ACCEPTED BY FREERDP (DRAFT GHSA) • FIXED IN MERGED PR #13941]
Privately reported to FreeRDP/FreeRDP via GitHub Private Vulnerability Reporting (GHSA-xxpf-vhg6-6873). Accepted by FreeRDP lead maintainer Armin Novak (@akallabeth) on 2026-10-31T05:36:01Z and fixed in merged Pull Request #13941 ([codec,h264] harden emscripten NAL parser).

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-xxpf-vhg6-6873",
  "repository": "FreeRDP/FreeRDP",
  "html_url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xxpf-vhg6-6873",
  "fix_pr": "https://github.com/FreeRDP/FreeRDP/pull/13941",
  "state": "draft (accepted by vendor, fix merged in #13941)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter"
    }
  ],
  "cwe_ids": [
    "CWE-125",
    "CWE-835"
  ]
}