Acorn421

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.29.0 **Description** An out-of-bounds heap read occurs in the UVC H.264 extension-unit parser when the system fails to validate the descriptor length before accessing the GUID field. A local attacker using a malicious USB video camera can trigger this read beyond allocated bounds during camera stream setup, resulting in a denial of service. **Recommendations** Update to version 3.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** protobufjs versions prior to 8.6.0 protobufjs versions prior to 7.6.3 **Description** protobufjs accepts certain schema-derived names that collide with properties used by runtime helpers. Specifically, this occurs with fields named `hasOwnProperty`, field or oneof names such as `$type` when loaded via JSON/reflection descriptors, and service methods that generate a helper name of `rpcCall`. When these types are used, the software may read schema-controlled data instead of the expected own-property helper, reflected type metadata, or base RPC helper. This can lead to deterministic exceptions or recursive calls during decode post-checks, verification, object conversion, reflected JSON serialization, or RPC helper invocation, potentially resulting in a denial of service for the affected processing path. **Recommendations** Update to version 8.6.0 or 7.6.3. Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources. If untrusted schemas must be accepted, validate and reject schema-derived field, oneof, and service method names that match the problematic names before loading. For trusted schemas, rename affected fields or service methods, or avoid the affected API path.