{"metadata": {"vulnerability": "cve-2026-109251", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109251", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:09:00.052Z", "date_only": false, "value": "2026-10-12T14:09:00.052Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109251", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:04:24.223Z", "date_only": false, "value": "2026-10-12T16:04:24.223Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109251", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:04:24.223Z", "date_only": false, "value": "2026-10-12T16:04:24.223Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109251", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:04:24.223Z", "date_only": false, "value": "2026-10-12T16:04:24.223Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109251", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:36:13.410Z", "date_only": false, "value": "2026-10-12T16:36:13.410491Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428910354810896", "record": "CVE-2026-109251", "field": "creation_timestamp", "uuid": "cdeb8467-3325-4f43-8065-ba16f5190079", "content": "CVE-2026-109251 FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109251https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-grvc-qhhp-7h6mhttps://www.vulncheck.com/advisories/freerdp-before-3.32.0-out-of-bounds-write-via-ms-rdpegt-video-geometry#FreeRDP#CVE_2026_109251#bot", "url": "https://infosec.exchange/users/cve/statuses/117428910354810896"}, {"timestamp": "2026-10-12T17:17:16Z", "date_only": false, "value": "2026-10-12T17:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WV34-X2FF-J6QM", "record": "GHSA-WV34-X2FF-J6QM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:16.380Z", "date_only": false, "value": "2026-10-12T17:17:16.380", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109251", "record": "FKIE_CVE-2026-109251", "field": "published"}, {"timestamp": "2026-10-12T18:31:38Z", "date_only": false, "value": "2026-10-12T18:31:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WV34-X2FF-J6QM", "record": "GHSA-WV34-X2FF-J6QM", "field": "published"}, {"timestamp": "2026-10-12T18:31:38Z", "date_only": false, "value": "2026-10-12T18:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WV34-X2FF-J6QM", "record": "GHSA-WV34-X2FF-J6QM", "field": "modified"}, {"timestamp": "2026-10-14T20:11:45.520Z", "date_only": false, "value": "2026-10-14T20:11:45.520", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109251", "record": "FKIE_CVE-2026-109251", "field": "lastModified"}]}