Every vulnerability matched against the SBOM of the MS Windows builds, since 2026-10-22 for the stable builds (the beta and LTS builds will be added later).
The SBOM vulnerabilities workflow scans the latest builds every day,
using the CPE and PURL references maintained by MSYS2 (msys2_sbom.py),
and fails when it finds a vulnerability which is not recorded below,
unless it only affects one of the ignored packages.
Packages without any CPE or PURL reference cannot be matched, so their vulnerabilities are not tracked by these scans (#5097).
| Column | |
|---|---|
CVE |
the vulnerability, in numerical order |
Package |
the packages it was matched against |
Severity |
as reported by the scanner |
Issue |
short description |
Upstream fix |
the first upstream version that fixes it, when known |
Live |
🔴 on if it applies to our builds, off if it does not (false positive, code we do not use, etc - say why in Notes): the scans no longer report it |
First xpra version |
the xpra version(s) where it was first found |
Fixed in xpra |
the first xpra version(s) with the fix |
Ticket |
link to the issue tracking it, if needed |
Notes |
analysis |
Some libraries are only bundled because another library we need links against them, but the code paths that would use them are never reached. The scans ignore every vulnerability found in these packages.
| Package | Reason |
|---|---|
libssh2 |
only used by curl for scp:// and sftp:// URLs, which nothing gives it: xpra’s own ssh connections use paramiko or the bundled OpenSSH |
p11-kit |
gnutls links against it, but its PKCS#11 modules are not bundled (BUILD.py deletes lib/p11-kit*), so there is nothing to load or talk to |
Image data received from the peer is only handed to Pillow once
open_only has recognized its header as one of the formats allowed in that context:
png, jpeg and webp for window pixels, cursors, icons and webcam framesbmp, ico, ppm and xpm for clipboard images on MS Windows (XPRA_CLIPBOARD_IMAGE_FORMATS)Animated PNG data, including PNG frames embedded in an ICO file, is detected as apng, which no context allows (#5096).
BUILD.py also deletes most Pillow plugins, and xpra.codecs.loader blocks many more, including TiffImagePlugin.
Xpra only processes the first image frame: it never seeks between frames or uses ImageSequence.Iterator.
The PSD, MPO, DCX and MIC loaders affected by CVE-2026-96639 are both removed from the MS Windows builds and blocked at import time.
An MPO file can start with a JPEG header, but Pillow cannot switch to the MPO loader when that plugin is absent.
BMP decoding is reachable through the MS Windows clipboard:
set_clipboard_image() allows BMP by default,
then image_to_bitmap() converts the image to RGBA, loading its pixels, including RLE-compressed BMP data.
JPEG decoding also parses EXIF implicitly:
Pillow’s _read_dpi_from_exif()
calls getexif() during Image.open() when EXIF is present and DPI is missing.
JPEG EXIF data can span multiple APP1 segments, so the size of one segment does not bound the total data passed to Exif.load().
The MS Windows builds ship the OpenSSL variant of libcurl, without the curl command line tool or the GStreamer curl plugins.
Xpra uses it through libproxy to download proxy auto-configuration (PAC) files.
The libproxy 0.5.12 downloader
sets CURLOPT_NOPROXY="*", bypassing proxies, and does not enable cookies, HSTS, Negotiate authentication,
client certificates, uploads, multipart MIME, FTP wildcard matching or interface binding.
It neither reads .netrc files nor queries CURLINFO_EFFECTIVE_URL.
It does enable CURLOPT_FOLLOWLOCATION without restricting redirect protocols.
Libcurl allows HTTP, HTTPS, FTP and FTPS redirects by default,
so downloading a PAC file can reach the FTP control-response parser even when the configured PAC URL uses HTTP or HTTPS.
SCP, SFTP and TFTP redirects are rejected by default.
Xpra does not use Python XML parsers on MS Windows.
Fontconfig uses Expat for local configuration files and
creates and frees a parser for each document, without XML_ParserReset.
The Expat parser in D-Bus GLib 0.114
is part of its build tools, which are not bundled; its runtime introspection parser uses GLib’s GMarkup.
The SVG loader uses libxml2 rather than Expat.
New vulnerabilities are added with:
curl -sSfLO https://xpra.org/stable/windows/Xpra-x86_64_6.5.5-r0.json
python3 packaging/MSWindows/msys2_sbom.py Xpra-x86_64_6.5.5-r0.json sbom.json
GRYPE_MATCH_PYTHON_USING_CPES=true GRYPE_MATCH_RUST_USING_CPES=true grype sbom:sbom.json --by-cve -o json > grype.json
python3 packaging/MSWindows/sbom_vulnerabilities.py --scan 6.5.5-r0 grype.json --update
| CVE | Package | Severity | Issue | Upstream fix | Live | First xpra version | Fixed in xpra | Ticket | Notes |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2005-2975 | gdk-pixbuf2 | High | io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) via a crafted XPM… | off | 6.5.5-r0 | GTK+ 2.x XPM loader bug, fixed in 2005: NVD’s CPE has no version bound | |||
| CVE-2005-3186 | gdk-pixbuf2 | High | Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number… | off | 6.5.5-r0 | GTK+ 2.x XPM loader bug, fixed in 2005: NVD’s CPE has no version bound | |||
| CVE-2021-30473 | aom | Critical | aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. | 2021-04-07 | off | 6.5.5-r0 | fixed in 2021, the scanner compares our version with a date | ||
| CVE-2021-30474 | aom | Critical | aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free. | 2021-03-30 | off | 6.5.5-r0 | fixed in 2021, the scanner compares our version with a date | ||
| CVE-2021-30475 | aom | Critical | aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. | 2021-03-24 | off | 6.5.5-r0 | fixed in 2021, the scanner compares our version with a date | ||
| CVE-2022-45142 | heimdal-libs | High | The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding “!= 0” comparisons to the result of memcmp. | unreleased | off | 6.5.5-r0 | the inverted RC4-HMAC checksum checks are present in heimdal 7.8.0 and MSYS2 does not patch them, but these libraries are only bundled for ssh.exe, and the OpenSSH client only creates GSSAPI tokens: it never verifies or unwraps any, unless patched for gssapi-keyex, which MSYS2’s OpenSSH is not |
||
| CVE-2023-4039 | gcc-libs, libgcc, libstdc++ | Medium | DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow… | 2023-09-12 | off | 6.5.5-r0 | AArch64 only, disputed, and the scanner compares our version with a date | ||
| CVE-2023-37769 | pixman | Medium | stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c. | off | 6.5.5-r0 | in pixman’s stress-test program, not in the library |
|||
| CVE-2023-39327 | openjpeg2 | Medium | Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. | unreleased | off | 6.5.5-r0 | no fix upstream and MSYS2 does not patch them, NVD’s CPE has no version bound, but nothing reaches the decoder: Pillow is the only user of libopenjp2 and BUILD.py deletes its Jpeg2KImagePlugin, and JPEG 2000 is not one of the image formats we parse |
||
| CVE-2023-39328 | openjpeg2 | Medium | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash… | unreleased | off | 6.5.5-r0 | no fix upstream and MSYS2 does not patch them, NVD’s CPE has no version bound, but nothing reaches the decoder: Pillow is the only user of libopenjp2 and BUILD.py deletes its Jpeg2KImagePlugin, and JPEG 2000 is not one of the image formats we parse |
||
| CVE-2023-39329 | openjpeg2 | Medium | A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. | unreleased | off | 6.5.5-r0 | no fix upstream and MSYS2 does not patch them, NVD’s CPE has no version bound, but nothing reaches the decoder: Pillow is the only user of libopenjp2 and BUILD.py deletes its Jpeg2KImagePlugin, and JPEG 2000 is not one of the image formats we parse |
||
| CVE-2023-50979 | crypto++ | Medium | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. | off | 6.5.5-r0 | unused, removed from the next release | |||
| CVE-2023-50980 | crypto++ | High | gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m)… | off | 6.5.5-r0 | unused, removed from the next release | |||
| CVE-2023-50981 | crypto++ | High | ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data… | off | 6.5.5-r0 | unused, removed from the next release | |||
| CVE-2024-3220 | python | Low | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other… | 3.14.9 | 🔴 on | 6.5.5-r0 | waiting for the next Python upstream release | ||
| CVE-2025-6021 | libxml2 | High | A flaw was found in libxml2’s xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. | 2.14.4 | off | 6.5.5-r0 | false positive: NVD lists every version from 2.0.0 onwards as affected, but the fix is in libxml2 2.14.4 and the stable builds ship 2.15.4 | ||
| CVE-2025-6170 | libxml2 | Low | A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. | off | 6.5.5-r0 | in the interactive shell of xmllint, which we do not ship |
|||
| CVE-2025-15367 | python | Medium | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. | 3.15.0a6 | off | 6.5.5-r0 | unused and unreachable: xpra does not use the poplib module |
||
| CVE-2025-32989 | gnutls | Medium | A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension… | 3.8.10 | off | 6.5.5-r0 | false positive: NVD lists every version as affected, but the fix (GNUTLS-SA-2025-07-07-1) is in gnutls 3.8.10 and the stable builds ship 3.8.13 | ||
| CVE-2025-32990 | gnutls | High | A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. | off | 6.5.5-r0 | in the certtool utility, which we do not ship |
|||
| CVE-2025-50422 | cairo | Low | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an “unscaled->face == NULL” assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | off | 6.6-r41819, 7.0-r42750 | unreachable: it needs a malformed font, xpra only renders text with the fonts installed on the system, it never loads fonts from the peer and librsvg does not load @font-face web fonts (the stable builds ship cairo 1.18.6) |
|||
| CVE-2026-1584 | gnutls | High | A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an… | off | 6.5.5-r0 | unreachable: gnutls is never used as a TLS server, it is only used as a client library by shishi (for python-gssapi): GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-3832 | gnutls | Low | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP)… | off | 6.5.5-r0 | unreachable by default: the only bundled gnutls TLS client is shishi’s STARTTLS to the KDC (for python-gssapi), which is only used when shishi.conf sets a realm’s KDC transport to tls, and which also accepts anonymous TLS without any certificate check: GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-3833 | gnutls | High | A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for… |
off | 6.5.5-r0 | unreachable by default: the only bundled gnutls TLS client is shishi’s STARTTLS to the KDC (for python-gssapi), which is only used when shishi.conf sets a realm’s KDC transport to tls, and which also accepts anonymous TLS without any certificate check: GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-4775 | libtiff | High | A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by… | off | 6.5.5-r0 | false positive: the stable builds ship libtiff 4.7.2 on both MS Windows and MacOS, which is not affected (the TIFF decoder is also blocked on MS Windows) | |||
| CVE-2026-5201 | gdk-pixbuf2 | High | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of… | 🔴 on | 6.5.5-r0 | #5092 | |||
| CVE-2026-12345 | python | Medium | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory… | 3.15.0rc3 | off | 6.5.5-r0 | tempfile.TemporaryDirectory is only used by our tests, which are not shipped |
||
| CVE-2026-12891 | gst-plugins-ugly, gstreamer | Medium | A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value,… | off | 6.5.5-r0 | in the gst-plugins-bad codec parsers, matched against other gstreamer packages via the shared CPE: the MS Windows builds do not include the GStreamer video codecs, GStreamer is only used for audio, and BUILD.py now deletes the codec parsers library and the GStreamer video elements |
|||
| CVE-2026-12892 | gst-plugins-ugly, gstreamer | Medium | A flaw was found in GStreamer’s gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension… | off | 6.5.5-r0 | in the gst-plugins-bad codec parsers, matched against other gstreamer packages via the shared CPE: the MS Windows builds do not include the GStreamer video codecs, GStreamer is only used for audio, and BUILD.py now deletes the codec parsers library and the GStreamer video elements |
|||
| CVE-2026-33845 | gnutls | Critical | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly… | off | 6.5.5-r0 | unreachable: nothing we bundle uses DTLS, gnutls is only used as a TLS client library by shishi (for python-gssapi): GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-42009 | gnutls | High | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. | off | 6.5.5-r0 | unreachable: nothing we bundle uses DTLS, gnutls is only used as a TLS client library by shishi (for python-gssapi): GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-42010 | gnutls | Critical | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character… | off | 6.5.5-r0 | unreachable: gnutls is never used as a TLS server, it is only used as a client library by shishi (for python-gssapi): GIO uses the openssl TLS backend and curl is the openssl variant |
|||
| CVE-2026-49264 | python-oauthlib | Medium | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. | 4.0.0 | off | 6.5.5-r0 | we only use oauthlib as an OAuth client, the vulnerability is in the server side endpoints |
||
| CVE-2026-49265 | python-oauthlib | Medium | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. | 4.0.0 | off | 6.5.5-r0 | we only use oauthlib as an OAuth client, the vulnerability is in the server side endpoints |
||
| CVE-2026-85091 | zlib | High | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite()… | off | 6.5.5-r0 | only in the gzFile API, when writing in non-blocking mode: nothing we bundle writes gzFile streams, Python’s zlib and gzip modules, libpng, freetype and cairo only use deflate / inflate |
|||
| CVE-2026-86410 | curl | High | A flaw in the curl command line tool’s logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a… | 8.23.0 | off | 6.5.5-r0 | in the curl command line tool, which we do not ship | ||
| CVE-2026-86412 | curl | High | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. | 8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable cookies or read or write cookie jars | ||
| CVE-2026-86413 | curl | Unknown | When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to… | 8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable HTTP Negotiate authentication or ambient credentials | ||
| CVE-2026-86414 | curl | Unknown | An HTTP proxy can trick libcurl into sending the origin’s credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the… | 8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader sets CURLOPT_NOPROXY="*", so it never sends an HTTP proxy CONNECT request |
||
| CVE-2026-86415 | curl | Unknown | libcurl’s connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection… | 8.23.0 | off | 6.5.5-r0 | Schannel only: the bundled libcurl uses OpenSSL, and the libproxy PAC downloader does not enable automatic client certificates | ||
| CVE-2026-87861 | curl | Unknown | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a… | 8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable HTTP Negotiate authentication or ambient credentials | ||
| CVE-2026-87862 | curl | Unknown | Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable HSTS or import an HSTS cache | ||
| CVE-2026-87863 | curl | Unknown | An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable HSTS or persist an HSTS cache | ||
| CVE-2026-87865 | curl | Unknown | When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader never installs a CURLOPT_SSH_KEYFUNCTION callback, and HTTP redirects cannot switch to SCP or SFTP |
||
| CVE-2026-87866 | curl | Critical | When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. | 8.23.0 | off | 6.5.5-r0 | wolfSSL only: the bundled libcurl uses OpenSSL, and the libproxy PAC downloader does not configure public key pinning | ||
| CVE-2026-87910 | python | Medium | When tarfile extracts a link on a system that doesn’t support links, it falls back to extracting a member from the archive. | 3.14.9 | off | 6.5.5-r0 | unused and unreachable: xpra does not use the tarfile module |
||
| CVE-2026-92386 | curl | High | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable cookies or read or write cookie jars | ||
| CVE-2026-92387 | curl | High | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its… | 8.23.0 | 🔴 on | 6.5.5-r0 | reachable through PAC downloads: libproxy enables redirects without restricting their protocols, and libcurl permits FTP / FTPS redirects by default; a malicious PAC endpoint can redirect to an FTP server that sends an unterminated control response stream, see libcurl | ||
| CVE-2026-92388 | curl | Unknown | When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable FTP wildcard matching (CURLOPT_WILDCARDMATCH) |
||
| CVE-2026-92389 | curl | Unknown | libcurl’s TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads… | 8.14.3, 8.16.2, 8.20.2 | off | 6.5.5-r0 | unreachable with HTTP(S) PAC URLs: libcurl rejects TFTP redirects, and the libproxy PAC downloader sets no upload or read callbacks; a manually configured TFTP PAC URL would need separate review | ||
| CVE-2026-92390 | curl | Unknown | When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints… |
8.23.0 | off | 6.5.5-r0 | in the curl command line tool (--remote-header-name / --etag-save), which we do not ship |
||
| CVE-2026-92391 | curl | Unknown | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. | 8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader only downloads data and never constructs multipart MIME structures | ||
| CVE-2026-92392 | curl | High | During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after… |
8.23.0 | off | 6.5.5-r0 | unreachable: the only thing loading libcurl is libproxy, which xpra uses to find the proxy settings, and it only downloads PAC files - it never uploads anything (the gstcurl plugins are not bundled) |
||
| CVE-2026-94265 | curl | Unknown | When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader does not enable HTTP Negotiate authentication or ambient credentials | ||
| CVE-2026-94266 | curl | Unknown | libcurl could accidentally return a URL for curl_easy_getinfo()’s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader neither enables .netrc credentials nor queries CURLINFO_EFFECTIVE_URL |
||
| CVE-2026-96636 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size… | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes MpoImagePlugin and DcxImagePlugin, which xpra.codecs.loader also blocks; xpra never seeks between image frames or uses ImageSequence.Iterator |
||
| CVE-2026-96637 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces… | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes SpiderImagePlugin, which xpra.codecs.loader also blocks, and SPIDER is not one of the image formats we parse |
||
| CVE-2026-96638 | python-pillow | Medium | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and… | 13.0.0 | 🔴 on | 6.5.5-r0 | reachable on MS Windows: set_clipboard_image() accepts BMP by default and image_to_bitmap() calls convert("RGBA") / tobytes(), entering BmpRleDecoder; window pixels do not need to use BMP, see image data |
||
| CVE-2026-96639 | python-pillow | Critical | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while… | 13.0.0 | off | 6.5.5-r0 | requires mode changes between PSD, MPO, DCX or MIC frames: BUILD.py deletes all four loaders and xpra.codecs.loader blocks them; xpra never seeks between image frames or uses ImageSequence.Iterator |
||
| CVE-2026-96640 | python-pillow | High | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree… | 13.0.0 | off | 6.5.5-r0 | only when appending to an existing PDF: BUILD.py deletes PdfImagePlugin, which xpra.codecs.loader also blocks, and xpra never uses PdfParser directly |
||
| CVE-2026-96641 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but… | 13.0.0 | off | 6.5.5-r0 | requires a PIL bitmap font with attacker-controlled negative glyph advances: xpra uses local TrueType fonts or Pillow’s bundled default font, and never loads fonts from the peer | ||
| CVE-2026-96642 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward… | 13.0.0 | off | 6.5.5-r0 | only through a direct call to PIL.TarIO.TarIO, which xpra never uses; Image.open() does not invoke it |
||
| CVE-2026-96643 | python-pillow | Medium | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with… | 13.0.0 | 🔴 on | 6.5.5-r0 | reachable through JPEG too: Pillow concatenates EXIF APP1 segments and JpegImageFile._read_dpi_from_exif() calls getexif() during Image.open() when DPI is missing, entering the same quadratic header-stripping loop before any TIFF import; xpra need not call getexif() itself |
||
| CVE-2026-96644 | python-pillow | High | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native… | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes WmfImagePlugin, which xpra.codecs.loader also blocks, and WMF / EMF are not among the image formats we parse with Pillow |
||
| CVE-2026-96778 | python-pillow | High | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM… | 13.0.0 | off | 6.5.5-r0 | requires forwarding an untrusted ICC profile when re-saving as JPEG: the pixel encoder creates images from raw pixels, and clipboard conversion calls img.save() without icc_profile, so the received profile is not forwarded to the JPEG encoder |
||
| CVE-2026-103995 | python | Low | Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents. | 3.16.0 | 🔴 on | 6.5.5-r0 | waiting for the next Python upstream release | ||
| CVE-2026-107928 | curl | Unknown | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. | 8.23.0 | off | 6.5.5-r0 | GnuTLS WebSocket send path only: the bundled libcurl uses OpenSSL, and the libproxy PAC downloader never uses WebSockets | ||
| CVE-2026-107929 | curl | Unknown | When CURLOPT_INTERFACE (or the command line tool’s --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that… |
8.23.0 | off | 6.5.5-r0 | unreachable: the libproxy PAC downloader never sets CURLOPT_INTERFACE |
||
| CVE-2026-111497 | brotli | Critical | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote… | 1.2.1 | 🔴 on | 6.5.5-r0 | reachable: xpra.net.brotli.decompressor passes peer-supplied compressed packet data to the native Brotli decoder, and the stable builds ship Brotli 1.2.0 |
||
| CVE-2026-112390 | python-pillow | High | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes MicImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse (olefile is not bundled either) |
||
| CVE-2026-112391 | python-pillow | High | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow’s PdfParser.get_value() can recurse without a limit while reading nested PDF objects. | 13.0.0 | off | 6.5.5-r0 | only when appending to an existing PDF: BUILD.py deletes PdfImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112392 | python-pillow | High | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s rank-based filters can dereference invalid image storage for a zero-size image. | 13.0.0 | off | 6.5.5-r0 | only via the rank filters, which xpra only uses if the server’s XPRA_IMAGEFILTER_* environment variables are set to use them |
||
| CVE-2026-112393 | python-pillow | Critical | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving… | 13.0.0 | off | 6.5.5-r0 | only when saving TIFF images: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112394 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s P;2L and P;4L raw decoders can read past the end of an input buffer. | 13.0.0 | off | 6.5.5-r0 | only via the P;2L and P;4L rawmodes, which xpra never uses, and which none of the image formats we parse use |
||
| CVE-2026-112395 | python-pillow | Medium | Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow’s tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. | 13.0.0 | off | 6.5.5-r0 | in the TIFF codec: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112396 | python-pillow | Medium | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an… | 13.0.0 | off | 6.5.5-r0 | only when saving TIFF images: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112397 | python-pillow | High | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. | 13.0.0 | off | 6.5.5-r0 | only via ImageMorph, which xpra never uses and BUILD.py deletes |
||
| CVE-2026-112398 | python-pillow | Critical | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes FpxImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse (olefile is not bundled either) |
||
| CVE-2026-112399 | python-pillow | High | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the… | 13.0.0 | off | 6.5.5-r0 | 8.0 | #5096 | xpra never generates APNG data: get_image_type() detects the acTL chunk, also in the PNG frames of ICO files, and reports it as apng, so it is rejected before reaching Pillow unless a caller explicitly allows apng, which none do, see image data |
| CVE-2026-112400 | python-pillow | High | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. | 13.0.0 | off | 6.5.5-r0 | in the GIF codec: BUILD.py deletes GifImagePlugin, and it is not one of the image formats we parse |
||
| CVE-2026-112401 | python-pillow | Medium | Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. | 13.0.0 | off | 6.5.5-r0 | in the GIF codec: BUILD.py deletes GifImagePlugin, and it is not one of the image formats we parse |
||
| CVE-2026-112402 | python-pillow | High | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. | 13.0.0 | off | 6.5.5-r0 | only via Image.transform(), which xpra never calls |
||
| CVE-2026-112403 | python-pillow | Critical | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. | 13.0.0 | off | 6.5.5-r0 | only when downscaling with draft() or thumbnail(), which xpra never calls |
||
| CVE-2026-112404 | python-pillow | High | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow’s TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. | 13.0.0 | off | 6.5.5-r0 | in the TIFF codec: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112405 | python-pillow | High | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow’s Image.merge() can dereference a null image8 plane. | 13.0.0 | off | 6.5.5-r0 | via IPTC files, or a direct call to Image.merge(), which xpra never makes: BUILD.py deletes IptcImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112406 | python-pillow | High | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. | 13.0.0 | off | 6.5.5-r0 | only when appending to an existing PDF: BUILD.py deletes PdfImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112891 | python-pillow | Medium | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header()… | 13.0.0 | off | 6.5.5-r0 | only when saving GIF images: BUILD.py deletes GifImagePlugin, and xpra only encodes png, jpeg and webp |
||
| CVE-2026-112892 | python-pillow | High | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow’s MSP RLE decoder can expand a small file into an unbounded in-memory buffer. | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes MspImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112893 | python-pillow | High | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. | 13.0.0 | off | 6.5.5-r0 | only when drawing text with a stroke width using a malformed font: xpra never draws stroked text and never loads fonts from the peer | ||
| CVE-2026-112894 | python-pillow | High | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with… | 13.0.0 | off | 6.5.5-r0 | only when saving a multi-frame PDF: BUILD.py deletes PdfImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112895 | python-pillow | High | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. | 13.0.0 | off | 6.5.5-r0 | only when appending to an existing PDF: BUILD.py deletes PdfImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-112896 | python-pillow | High | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size… | 13.0.0 | off | 6.5.5-r0 | only when saving TIFF images: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112897 | python-pillow | High | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of… | 13.0.0 | off | 6.5.5-r0 | in the TIFF codec: xpra.codecs.loader blocks TiffImagePlugin so Pillow can neither open nor save TIFF images, and it is not one of the image formats we parse |
||
| CVE-2026-112898 | python-pillow | Medium | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. | 13.0.0 | off | 6.5.5-r0 | only via Image.quantize(), which xpra never calls: the png encoder converts to the fixed WEB palette |
||
| CVE-2026-112900 | python-pillow | Critical | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes EpsImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse, Ghostscript is not bundled either |
||
| CVE-2026-112901 | python-pillow | Medium | Pillow is a Python imaging library. Prior to 13.0.0, Pillow’s XBM header parser is vulnerable to regular-expression denial of service. | 13.0.0 | off | 6.5.5-r0 | BUILD.py deletes XbmImagePlugin, which xpra.codecs.loader also blocks, and it is not one of the image formats we parse |
||
| CVE-2026-113351 | expat | High | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap… | off | 6.5.5-r0 | requires reusing an Expat parser after XML_ParserReset: xpra does not use Python XML parsers on MS Windows, and fontconfig creates and frees a parser per configuration document; the D-Bus GLib Expat parser is in its build tools, which we do not ship |
|||
| CVE-2026-113679 | harfbuzz | High | HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import… | 15.0.0 | off | 6.5.5-r0 | in the experimental WebAssembly shaper: HarfBuzz 14.6.0 defaults to wasm=disabled and MSYS2 does not enable it; xpra never loads fonts from the peer |
||
| CVE-2026-113680 | harfbuzz | Medium | HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports… | 15.0.0 | off | 6.5.5-r0 | in the experimental WebAssembly shaper: HarfBuzz 14.6.0 defaults to wasm=disabled and MSYS2 does not enable it; xpra never loads fonts from the peer |
||
| CVE-2026-114501 | python-pillow | Medium | Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image’s rows are tightly contiguous and exports from… | 13.0.0 | off | 6.5.5-r0 | only when exporting images through the Arrow interface with custom alignment: xpra never exports Pillow images to Arrow or uses pyarrow |
||
| CVE-2026-114583 | python | Medium | tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members… | 3.14.10 | off | 6.5.5-r0 | in tarfile.tar_filter during archive extraction: xpra does not use tarfile or extract received tar archives |
||
| CVE-2026-115506 | expat | High | libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects… | off | 6.5.5-r0 | requires parsing attacker-controlled XML with Expat: xpra does not use Python XML parsers on MS Windows; fontconfig reads local configuration, the D-Bus GLib Expat parser is in unbundled build tools, and the SVG loader uses libxml2 | |||
| CVE-2026-115557 | python | Critical | Python has added a denylist for known compromised certificates to the “ssl” module to ensure user safety even without certificate revocation configured. | 3.14.10 | 🔴 on | 6.5.5-r0 | reachable when TLS validation trusts the compromised eMudhra intermediate CAs: xpra uses Python’s ssl module for SSL / WSS connections and Python 3.14.8 lacks the upstream denylist; a private CA or pinned server certificate avoids relying on those CAs |
||
| CVE-2026-117610 | expat | High | Expat through 2.9.0 can crash after an empty non-final first parse on an external-entity subparser. | 2.10.0 | off | 6.5.5-r0 | requires an external-entity subparser and an empty non-final first parse: the XML parsing paths used by xpra do not create these subparsers; fontconfig reads local configuration, the D-Bus GLib Expat parser is in unbundled build tools, and SVG uses libxml2; UPnPy is not included in our binary builds | ||
| CVE-2026-118370 | expat | High | Expat through 2.9.0 can overflow signed attribute counters and write outside heap buffers when one element has over a billion attributes. | 2.10.0 | off | 6.5.5-r0 | requires multi-gigabyte XML with roughly a billion attributes on one element; D-Bus introspection XML is bounded by the 128 MiB message limit, far below the required size; fontconfig, pyxdg and plistlib read local configuration, and SVG uses libxml2; UPnPy is not included in our binary builds, so its unbounded parsing of network XML is unreachable |