{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-55194: fix heap buffer overflow in TS Gateway RPC response\n reassembly; ensure remaining capacity for the actual stub length\n- CVE-2026-55648: add an overflow-safe cbBitsColor source length check\n to freerdp_image_copy_from_icon_data", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/advisories/2026/clsa-2026_1793195124.json" } ], "tracking": { "current_release_date": "2026-10-30T14:20:29Z", "generator": { "date": "2026-10-30T14:20:28Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793195124", "initial_release_date": "2026-10-28T13:49:50Z", "revision_history": [ { "date": "2026-10-28T13:49:50Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-30T14:20:29Z", "number": "2", "summary": "Update document" } ], "status": "final", "version": "2" }, "title": "freerdp: Fix of 79 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product": { "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_id": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=i686" } } }, { "category": "product_version", "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product": { "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_id": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp-devel@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=i686" } } }, { "category": "product_version", "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product": { "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_id": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libwinpr-devel@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=i686" } } }, { "category": "product_version", "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product": { "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_id": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libwinpr@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=i686" } } }, { "category": "product_version", "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product": { "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_id": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp-libs@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product": { "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_id": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product": { "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_id": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp-devel@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product": { "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_id": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libwinpr-devel@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product": { "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_id": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libwinpr@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product": { "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_id": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/freerdp-libs@2.1.1-5.0.9.el7_9.tuxcare.els7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686" }, "product_reference": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" }, "product_reference": "freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" }, "product_reference": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686" }, "product_reference": "freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686" }, "product_reference": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" }, "product_reference": "libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686" }, "product_reference": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" }, "product_reference": "libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" }, "product_reference": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686" }, "product_reference": "freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-68580", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68580" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel", "url": "https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel" } ], "release_date": "2026-08-02T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-39350", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39350" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/e204fc8be5a372626b13f66daf2abafe71dbc2dc", "url": "https://github.com/FreeRDP/FreeRDP/commit/e204fc8be5a372626b13f66daf2abafe71dbc2dc" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-40188", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40188" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/nsc.c#L115-L175", "url": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/nsc.c#L115-L175" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-67289", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67289" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f", "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection", "url": "https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23534", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23534" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L878-L879", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L878-L879" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L883-L884", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L883-L884" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3frr-mp8w-4599", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3frr-mp8w-4599" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23534", "url": "https://access.redhat.com/security/cve/CVE-2026-23534" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430888" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23534.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23534.json" } ], "release_date": "2026-01-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-57158", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-57158" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731", "url": "https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/12952", "url": "https://github.com/FreeRDP/FreeRDP/pull/12952" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp" } ], "release_date": "2026-07-10T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-32458", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32458" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-22T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-39352", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39352" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239", "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-25941", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25941" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2", "url": "https://github.com/FreeRDP/FreeRDP/commit/2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8" } ], "release_date": "2026-02-25T20:23:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-67288", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67288" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f", "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f", "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache", "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-22854", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22854" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23532", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23532" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/gdi/gfx.c#L1368-L1382", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/gdi/gfx.c#L1368-L1382" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2714", "url": "https://access.redhat.com/errata/RHSA-2026:2714" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2770", "url": "https://access.redhat.com/errata/RHSA-2026:2770" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2824", "url": "https://access.redhat.com/errata/RHSA-2026:2824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3036", "url": "https://access.redhat.com/errata/RHSA-2026:3036" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3038", "url": "https://access.redhat.com/errata/RHSA-2026:3038" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3039", "url": "https://access.redhat.com/errata/RHSA-2026:3039" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3041", "url": "https://access.redhat.com/errata/RHSA-2026:3041" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23532", "url": "https://access.redhat.com/security/cve/CVE-2026-23532" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430891" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23532.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23532.json" } ], "release_date": "2026-01-19T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-39356", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39356" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/include/freerdp/primary.h#L186-L196", "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/include/freerdp/primary.h#L186-L196" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/core/orders.c#L1503-L1504", "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/core/orders.c#L1503-L1504" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gdi.c#L723C1-L758", "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gdi.c#L723C1-L758" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5v5-qhj5-mh6m", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5v5-qhj5-mh6m" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-25953", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25953" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1237", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1237" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L257-L290", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L257-L290" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643-L647", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643-L647" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394-L1428", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394-L1428" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1462-L1470", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1462-L1470" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1491", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1491" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L254-L286", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L254-L286" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L278-L279", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L278-L279" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5", "url": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6rq-rxpc-rh3p", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6rq-rxpc-rh3p" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23732", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23732" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/cache/glyph.c#L463-L480", "url": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/cache/glyph.c#L463-L480" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/codec/color.c#L261-L277", "url": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/codec/color.c#L261-L277" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/graphics.c#L138", "url": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/graphics.c#L138" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/orders.c#L2186C17-L2199", "url": "https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/orders.c#L2186C17-L2199" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp" } ], "release_date": "2026-01-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-24676", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24676" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00", "url": "https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qh5p-frq4-pgxj", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qh5p-frq4-pgxj" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32460", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32460" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-22T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-25954", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25954" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1076", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1076" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1133", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1133" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1347", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1347" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1350-L1359", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1350-L1359" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L647", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L647" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5", "url": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-40181", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40181" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L256-L261", "url": "https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L256-L261" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L334-L355", "url": "https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L334-L355" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-32041", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32041" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" } ], "release_date": "2024-04-22T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23884", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23884" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L114-L122", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L114-L122" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L87-L91", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L87-L91" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2714", "url": "https://access.redhat.com/errata/RHSA-2026:2714" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2770", "url": "https://access.redhat.com/errata/RHSA-2026:2770" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2824", "url": "https://access.redhat.com/errata/RHSA-2026:2824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3036", "url": "https://access.redhat.com/errata/RHSA-2026:3036" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3038", "url": "https://access.redhat.com/errata/RHSA-2026:3038" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3039", "url": "https://access.redhat.com/errata/RHSA-2026:3039" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3041", "url": "https://access.redhat.com/errata/RHSA-2026:3041" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23884", "url": "https://access.redhat.com/security/cve/CVE-2026-23884" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430880" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23884.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23884.json" } ], "release_date": "2026-01-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-24684", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24684" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696", "url": "https://github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5", "url": "https://github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcgv-xgjp-h83q", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcgv-xgjp-h83q" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-22211", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-22211" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff", "url": "https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/aeac3040cc99eeaff1e1171a822114c857b9dca9", "url": "https://github.com/FreeRDP/FreeRDP/commit/aeac3040cc99eeaff1e1171a822114c857b9dca9" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rjhp-44rv-7v59", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rjhp-44rv-7v59" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44VOA5KQQT7KQPW7CLST4Y4SQTKK3IOU/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44VOA5KQQT7KQPW7CLST4Y4SQTKK3IOU/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQE3YSPOJPAUS7DPWIBTR5IQSQX35VM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQE3YSPOJPAUS7DPWIBTR5IQSQX35VM/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-01-19T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-22859", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22859" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3067", "url": "https://access.redhat.com/errata/RHSA-2026:3067" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3068", "url": "https://access.redhat.com/errata/RHSA-2026:3068" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3334", "url": "https://access.redhat.com/errata/RHSA-2026:3334" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3975", "url": "https://access.redhat.com/errata/RHSA-2026:3975" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4121", "url": "https://access.redhat.com/errata/RHSA-2026:4121" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4433", "url": "https://access.redhat.com/errata/RHSA-2026:4433" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4437", "url": "https://access.redhat.com/errata/RHSA-2026:4437" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4438", "url": "https://access.redhat.com/errata/RHSA-2026:4438" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4439", "url": "https://access.redhat.com/errata/RHSA-2026:4439" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4440", "url": "https://access.redhat.com/errata/RHSA-2026:4440" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4446", "url": "https://access.redhat.com/errata/RHSA-2026:4446" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4471", "url": "https://access.redhat.com/errata/RHSA-2026:4471" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4489", "url": "https://access.redhat.com/errata/RHSA-2026:4489" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-22859", "url": "https://access.redhat.com/security/cve/CVE-2026-22859" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2429653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429653" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22859.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22859.json" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-67299", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67299" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f", "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message", "url": "https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-40033", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40033" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/d7508ebcd82842a691ae4941e5104d14240a89ae", "url": "https://github.com/FreeRDP/FreeRDP/commit/d7508ebcd82842a691ae4941e5104d14240a89ae" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/12713", "url": "https://github.com/FreeRDP/FreeRDP/pull/12713" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-in-gdi-cachetosurface-via-rectangle-validation-bypass", "url": "https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-in-gdi-cachetosurface-via-rectangle-validation-bypass" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36203", "url": "https://access.redhat.com/errata/RHSA-2026:36203" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46393", "url": "https://access.redhat.com/errata/RHSA-2026:46393" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-40033", "url": "https://access.redhat.com/security/cve/CVE-2026-40033" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2481473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481473" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40033.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40033.json" } ], "release_date": "2026-05-26T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-67300", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67300" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f", "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-message-proxy", "url": "https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-message-proxy" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-91964", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-91964" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken", "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken" } ], "release_date": "2026-09-15T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-24491", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24491" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/e02e052f6692550e539d10f99de9c35a23492db2", "url": "https://github.com/FreeRDP/FreeRDP/commit/e02e052f6692550e539d10f99de9c35a23492db2" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4x6j-w49r-869g", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4x6j-w49r-869g" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-40589", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40589" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416", "url": "https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-25959", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls `xf_cliprdr_clear_cached_data` → `HashTable_Clear` which frees the same data via `xf_cached_data_free`, triggering a heap use after free. Version 3.23.0 fixes the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25959" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1229-L1243", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1229-L1243" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1337-L1344", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1337-L1344" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L200-L208", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L200-L208" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2295", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2295" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2323-L2334", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2323-L2334" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2363", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2363" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L933", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L933" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/d3e8b3b9365be96a4f11dda149d71b3287227d0a", "url": "https://github.com/FreeRDP/FreeRDP/commit/d3e8b3b9365be96a4f11dda149d71b3287227d0a" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-39282", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-39282" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202210-24", "url": "https://security.gentoo.org/glsa/202210-24" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2022-10-12T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23531", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23531" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L1139-L1145", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L1139-L1145" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2714", "url": "https://access.redhat.com/errata/RHSA-2026:2714" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2770", "url": "https://access.redhat.com/errata/RHSA-2026:2770" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2824", "url": "https://access.redhat.com/errata/RHSA-2026:2824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3036", "url": "https://access.redhat.com/errata/RHSA-2026:3036" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3038", "url": "https://access.redhat.com/errata/RHSA-2026:3038" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3039", "url": "https://access.redhat.com/errata/RHSA-2026:3039" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3041", "url": "https://access.redhat.com/errata/RHSA-2026:3041" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23531", "url": "https://access.redhat.com/security/cve/CVE-2026-23531" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430887" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23531.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23531.json" } ], "release_date": "2026-01-19T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-32459", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32459" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-22T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64624", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64624" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options", "url": "https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options" } ], "release_date": "2026-07-20T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31897", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31897" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/cd27c8faca0eeb0d4309cc5837dfdf3c42eba4e7", "url": "https://github.com/FreeRDP/FreeRDP/commit/cd27c8faca0eeb0d4309cc5837dfdf3c42eba4e7" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xgv6-r22m-7c9x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xgv6-r22m-7c9x" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-66402", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-66402" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd", "url": "https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass", "url": "https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-22852", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22852" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-91953", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-91953" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info", "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info" } ], "release_date": "2026-09-15T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-29775", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-29775" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f", "url": "https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32039", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32039" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-22T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-39283", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-39283" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202210-24", "url": "https://security.gentoo.org/glsa/202210-24" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2022-10-12T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-26955", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-26955" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77", "url": "https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5936", "url": "https://access.redhat.com/errata/RHSA-2026:5936" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5939", "url": "https://access.redhat.com/errata/RHSA-2026:5939" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6004", "url": "https://access.redhat.com/errata/RHSA-2026:6004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6005", "url": "https://access.redhat.com/errata/RHSA-2026:6005" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6384", "url": "https://access.redhat.com/errata/RHSA-2026:6384" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6385", "url": "https://access.redhat.com/errata/RHSA-2026:6385" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6395", "url": "https://access.redhat.com/errata/RHSA-2026:6395" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6396", "url": "https://access.redhat.com/errata/RHSA-2026:6396" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6616", "url": "https://access.redhat.com/errata/RHSA-2026:6616" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6665", "url": "https://access.redhat.com/errata/RHSA-2026:6665" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6712", "url": "https://access.redhat.com/errata/RHSA-2026:6712" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6764", "url": "https://access.redhat.com/errata/RHSA-2026:6764" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7292", "url": "https://access.redhat.com/errata/RHSA-2026:7292" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-26955", "url": "https://access.redhat.com/security/cve/CVE-2026-26955" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2443132", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443132" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26955.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26955.json" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32661", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32661" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/71e463e31b4d69f4022d36bfc814592f56600793", "url": "https://github.com/FreeRDP/FreeRDP/commit/71e463e31b4d69f4022d36bfc814592f56600793" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-23T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32040", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32040" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/10077", "url": "https://github.com/FreeRDP/FreeRDP/pull/10077" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-22T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-33985", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33985" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25", "url": "https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85" } ], "release_date": "2026-03-30T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-24883", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-24883" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc", "url": "https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144", "url": "https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202210-24", "url": "https://security.gentoo.org/glsa/202210-24" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2022-04-26T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-22857", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22857" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23533", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23533" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L268-L281", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L268-L281" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L336", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L336" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2714", "url": "https://access.redhat.com/errata/RHSA-2026:2714" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2770", "url": "https://access.redhat.com/errata/RHSA-2026:2770" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2824", "url": "https://access.redhat.com/errata/RHSA-2026:2824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3036", "url": "https://access.redhat.com/errata/RHSA-2026:3036" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3038", "url": "https://access.redhat.com/errata/RHSA-2026:3038" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3039", "url": "https://access.redhat.com/errata/RHSA-2026:3039" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3041", "url": "https://access.redhat.com/errata/RHSA-2026:3041" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23533", "url": "https://access.redhat.com/security/cve/CVE-2026-23533" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430886", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430886" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23533.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23533.json" } ], "release_date": "2026-01-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-31883", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31883" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8", "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-24681", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24681" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/414f701464929c217f2509bcbd6d2c1f00f7ed73", "url": "https://github.com/FreeRDP/FreeRDP/commit/414f701464929c217f2509bcbd6d2c1f00f7ed73" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ccvv-hg2w-6x9j", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ccvv-hg2w-6x9j" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-24679", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24679" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31", "url": "https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-55648", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-55648" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3", "url": "https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/12877", "url": "https://github.com/FreeRDP/FreeRDP/pull/12877" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6" } ], "release_date": "2026-08-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-40567", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40567" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L612-L618", "url": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L612-L618" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L843-L845", "url": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L843-L845" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-22856", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22856" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23530", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23530" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953", "url": "https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2048", "url": "https://access.redhat.com/errata/RHSA-2026:2048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2081", "url": "https://access.redhat.com/errata/RHSA-2026:2081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2222", "url": "https://access.redhat.com/errata/RHSA-2026:2222" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2714", "url": "https://access.redhat.com/errata/RHSA-2026:2714" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2736", "url": "https://access.redhat.com/errata/RHSA-2026:2736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2770", "url": "https://access.redhat.com/errata/RHSA-2026:2770" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2824", "url": "https://access.redhat.com/errata/RHSA-2026:2824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2952", "url": "https://access.redhat.com/errata/RHSA-2026:2952" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3036", "url": "https://access.redhat.com/errata/RHSA-2026:3036" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3037", "url": "https://access.redhat.com/errata/RHSA-2026:3037" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3038", "url": "https://access.redhat.com/errata/RHSA-2026:3038" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3039", "url": "https://access.redhat.com/errata/RHSA-2026:3039" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3041", "url": "https://access.redhat.com/errata/RHSA-2026:3041" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23530", "url": "https://access.redhat.com/security/cve/CVE-2026-23530" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430877" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23530.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23530.json" } ], "release_date": "2026-01-19T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-55194", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-55194" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a", "url": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/12873", "url": "https://github.com/FreeRDP/FreeRDP/pull/12873" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx" } ], "release_date": "2026-08-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-55564", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-55564" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f", "url": "https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/pull/12885", "url": "https://github.com/FreeRDP/FreeRDP/pull/12885" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6xmj-pr98-cx4c", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6xmj-pr98-cx4c" } ], "release_date": "2026-08-19T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-26965", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-26965" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc", "url": "https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5936", "url": "https://access.redhat.com/errata/RHSA-2026:5936" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5939", "url": "https://access.redhat.com/errata/RHSA-2026:5939" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6004", "url": "https://access.redhat.com/errata/RHSA-2026:6004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6005", "url": "https://access.redhat.com/errata/RHSA-2026:6005" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6384", "url": "https://access.redhat.com/errata/RHSA-2026:6384" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6385", "url": "https://access.redhat.com/errata/RHSA-2026:6385" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6395", "url": "https://access.redhat.com/errata/RHSA-2026:6395" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6396", "url": "https://access.redhat.com/errata/RHSA-2026:6396" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6616", "url": "https://access.redhat.com/errata/RHSA-2026:6616" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6665", "url": "https://access.redhat.com/errata/RHSA-2026:6665" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6712", "url": "https://access.redhat.com/errata/RHSA-2026:6712" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6764", "url": "https://access.redhat.com/errata/RHSA-2026:6764" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7292", "url": "https://access.redhat.com/errata/RHSA-2026:7292" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-26965", "url": "https://access.redhat.com/security/cve/CVE-2026-26965" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2442959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442959" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26965.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26965.json" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31806", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31806" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b", "url": "https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10076", "url": "https://access.redhat.com/errata/RHSA-2026:10076" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10734", "url": "https://access.redhat.com/errata/RHSA-2026:10734" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10735", "url": "https://access.redhat.com/errata/RHSA-2026:10735" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10951", "url": "https://access.redhat.com/errata/RHSA-2026:10951" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11323", "url": "https://access.redhat.com/errata/RHSA-2026:11323" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6340", "url": "https://access.redhat.com/errata/RHSA-2026:6340" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6727", "url": "https://access.redhat.com/errata/RHSA-2026:6727" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6743", "url": "https://access.redhat.com/errata/RHSA-2026:6743" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6799", "url": "https://access.redhat.com/errata/RHSA-2026:6799" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6918", "url": "https://access.redhat.com/errata/RHSA-2026:6918" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6958", "url": "https://access.redhat.com/errata/RHSA-2026:6958" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9640", "url": "https://access.redhat.com/errata/RHSA-2026:9640" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9641", "url": "https://access.redhat.com/errata/RHSA-2026:9641" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-31806", "url": "https://access.redhat.com/security/cve/CVE-2026-31806" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447376" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31806.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31806.json" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-40186", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40186" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/fee2b10ba1154f952769a53eb608f044782e22f8/libfreerdp/gdi/gfx.c#L1156-L1165", "url": "https://github.com/FreeRDP/FreeRDP/blob/fee2b10ba1154f952769a53eb608f044782e22f8/libfreerdp/gdi/gfx.c#L1156-L1165" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-67301", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67301" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f", "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy", "url": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-25952", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25952" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5", "url": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-39351", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39351" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q9x9-cqjc-rgwq", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q9x9-cqjc-rgwq" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32659", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32659" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/6430945ce003a5e24d454d8566f54aae1b6b617b", "url": "https://github.com/FreeRDP/FreeRDP/commit/6430945ce003a5e24d454d8566f54aae1b6b617b" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://oss-fuzz.com/testcase-detail/6156779722440704", "url": "https://oss-fuzz.com/testcase-detail/6156779722440704" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-23T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-39353", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39353" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/codec/rfx.c#L994-L996", "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/codec/rfx.c#L994-L996" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg53-9j9h-3c8f", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg53-9j9h-3c8f" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-32660", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32660" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/5e5d27cf310e4c10b854be7667bfb7a5d774eb47", "url": "https://github.com/FreeRDP/FreeRDP/commit/5e5d27cf310e4c10b854be7667bfb7a5d774eb47" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://oss-fuzz.com/testcase-detail/5559242514825216", "url": "https://oss-fuzz.com/testcase-detail/5559242514825216" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-23T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31884", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31884" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/03b48b3601d867afccac1cdc6081de7a275edce7", "url": "https://github.com/FreeRDP/FreeRDP/commit/03b48b3601d867afccac1cdc6081de7a275edce7" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8", "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31885", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31885" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8", "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3" } ], "release_date": "2026-03-13T19:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-33983", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33983" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425", "url": "https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10709", "url": "https://access.redhat.com/errata/RHSA-2026:10709" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11332", "url": "https://access.redhat.com/errata/RHSA-2026:11332" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11333", "url": "https://access.redhat.com/errata/RHSA-2026:11333" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11336", "url": "https://access.redhat.com/errata/RHSA-2026:11336" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11649", "url": "https://access.redhat.com/errata/RHSA-2026:11649" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11651", "url": "https://access.redhat.com/errata/RHSA-2026:11651" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12359", "url": "https://access.redhat.com/errata/RHSA-2026:12359" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12388", "url": "https://access.redhat.com/errata/RHSA-2026:12388" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19349", "url": "https://access.redhat.com/errata/RHSA-2026:19349" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8457", "url": "https://access.redhat.com/errata/RHSA-2026:8457" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8458", "url": "https://access.redhat.com/errata/RHSA-2026:8458" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8945", "url": "https://access.redhat.com/errata/RHSA-2026:8945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9656", "url": "https://access.redhat.com/errata/RHSA-2026:9656" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33983", "url": "https://access.redhat.com/security/cve/CVE-2026-33983" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2453220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453220" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33983.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33983.json" } ], "release_date": "2026-03-30T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-45700", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-45700" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36203", "url": "https://access.redhat.com/errata/RHSA-2026:36203" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37207", "url": "https://access.redhat.com/errata/RHSA-2026:37207" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:38501", "url": "https://access.redhat.com/errata/RHSA-2026:38501" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46383", "url": "https://access.redhat.com/errata/RHSA-2026:46383" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46384", "url": "https://access.redhat.com/errata/RHSA-2026:46384" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46388", "url": "https://access.redhat.com/errata/RHSA-2026:46388" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46389", "url": "https://access.redhat.com/errata/RHSA-2026:46389" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46393", "url": "https://access.redhat.com/errata/RHSA-2026:46393" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47048", "url": "https://access.redhat.com/errata/RHSA-2026:47048" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47049", "url": "https://access.redhat.com/errata/RHSA-2026:47049" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47201", "url": "https://access.redhat.com/errata/RHSA-2026:47201" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-45700", "url": "https://access.redhat.com/security/cve/CVE-2026-45700" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2483470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483470" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45700.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45700.json" } ], "release_date": "2026-05-29T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-27951", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-27951" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113", "url": "https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927" } ], "release_date": "2026-02-25T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-67291", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-67291" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f", "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add", "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add" } ], "release_date": "2026-08-01T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-26986", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-26986" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404", "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51", "url": "https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47" } ], "release_date": "2026-02-25T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-25942", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25942" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46", "url": "https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b", "url": "https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6" } ], "release_date": "2026-02-25T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-33984", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33984" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5", "url": "https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10709", "url": "https://access.redhat.com/errata/RHSA-2026:10709" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11332", "url": "https://access.redhat.com/errata/RHSA-2026:11332" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11333", "url": "https://access.redhat.com/errata/RHSA-2026:11333" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11336", "url": "https://access.redhat.com/errata/RHSA-2026:11336" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11649", "url": "https://access.redhat.com/errata/RHSA-2026:11649" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:11651", "url": "https://access.redhat.com/errata/RHSA-2026:11651" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12359", "url": "https://access.redhat.com/errata/RHSA-2026:12359" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12388", "url": "https://access.redhat.com/errata/RHSA-2026:12388" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19349", "url": "https://access.redhat.com/errata/RHSA-2026:19349" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8457", "url": "https://access.redhat.com/errata/RHSA-2026:8457" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8458", "url": "https://access.redhat.com/errata/RHSA-2026:8458" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8945", "url": "https://access.redhat.com/errata/RHSA-2026:8945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9656", "url": "https://access.redhat.com/errata/RHSA-2026:9656" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33984", "url": "https://access.redhat.com/security/cve/CVE-2026-33984" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2453219", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453219" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33984.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33984.json" } ], "release_date": "2026-03-30T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-40569", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-40569" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/progressive.c#L2598-L2616", "url": "https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/progressive.c#L2598-L2616" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hm8c-rcjg-c8qp", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hm8c-rcjg-c8qp" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-16", "url": "https://security.gentoo.org/glsa/202401-16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2023-08-31T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-24675", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-24675" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/d676518809c319eec15911c705c13536036af2ae", "url": "https://github.com/FreeRDP/FreeRDP/commit/d676518809c319eec15911c705c13536036af2ae" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x9jr-99h2-g7mj", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x9jr-99h2-g7mj" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-32658", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-32658" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf", "url": "https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/" }, { "category": "external", "summary": "https://oss-fuzz.com/testcase-detail/4852534033317888", "url": "https://oss-fuzz.com/testcase-detail/4852534033317888" }, { "category": "external", "summary": "https://oss-fuzz.com/testcase-detail/6196819496337408", "url": "https://oss-fuzz.com/testcase-detail/6196819496337408" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html" } ], "release_date": "2024-04-23T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23948", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23948" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860", "url": "https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6f3c-qvqq-2px5", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6f3c-qvqq-2px5" } ], "release_date": "2026-02-09T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-22855", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22855" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1", "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19033", "url": "https://access.redhat.com/errata/RHSA-2026:19033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3067", "url": "https://access.redhat.com/errata/RHSA-2026:3067" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3068", "url": "https://access.redhat.com/errata/RHSA-2026:3068" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3334", "url": "https://access.redhat.com/errata/RHSA-2026:3334" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3975", "url": "https://access.redhat.com/errata/RHSA-2026:3975" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4121", "url": "https://access.redhat.com/errata/RHSA-2026:4121" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4437", "url": "https://access.redhat.com/errata/RHSA-2026:4437" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4438", "url": "https://access.redhat.com/errata/RHSA-2026:4438" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4439", "url": "https://access.redhat.com/errata/RHSA-2026:4439" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4440", "url": "https://access.redhat.com/errata/RHSA-2026:4440" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4446", "url": "https://access.redhat.com/errata/RHSA-2026:4446" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4471", "url": "https://access.redhat.com/errata/RHSA-2026:4471" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4489", "url": "https://access.redhat.com/errata/RHSA-2026:4489" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-22855", "url": "https://access.redhat.com/security/cve/CVE-2026-22855" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2429645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429645" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22855.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22855.json" } ], "release_date": "2026-01-14T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-109242", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-109242" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade", "url": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade" } ], "release_date": "2026-10-12T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-44421", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-44421" }, { "category": "external", "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36203", "url": "https://access.redhat.com/errata/RHSA-2026:36203" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46393", "url": "https://access.redhat.com/errata/RHSA-2026:46393" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44421", "url": "https://access.redhat.com/security/cve/CVE-2026-44421" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2483471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483471" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44421.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44421.json" } ], "release_date": "2026-05-29T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-28T13:45:26.056645Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124", "product_ids": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793195124" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:freerdp-libs-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.i686", "Red-Hat-7:libwinpr-devel-0:2.1.1-5.0.9.el7_9.tuxcare.els7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }