Vulnerability-Lookup

RHSA-2026:19358

Vulnerability from csaf_opensuse - Published: 2026-05-19 00:00 - Updated: 2026-09-16 18:18

Summary

security update for freerdp

Severity

Moderate

Notes

Title of the patch: security update for freerdp

Description of the patch: This security update provides a functional equivalent of RHSA-2026:19358. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:19358.

Patchnames: RHSA-2026:19358

CVE-2026-25952

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-26986

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact moderate

CVE-2026-27951

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact moderate

CVE-2026-29775

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact low

CVE-2026-31883

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact important

CVE-2026-31884

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact moderate

CVE-2026-31885

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact important

CVE-2026-33985

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2026-25952

Threats

Impact moderate

References

28 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-25952/	self
https://www.suse.com/security/cve/CVE-2026-26986/	self
https://www.suse.com/security/cve/CVE-2026-27951/	self
https://www.suse.com/security/cve/CVE-2026-29775/	self
https://www.suse.com/security/cve/CVE-2026-31883/	self
https://www.suse.com/security/cve/CVE-2026-31884/	self
https://www.suse.com/security/cve/CVE-2026-31885/	self
https://www.suse.com/security/cve/CVE-2026-33985/	self
https://www.suse.com/security/cve/CVE-2026-25952	external
https://bugzilla.suse.com/1258921	external
https://www.suse.com/security/cve/CVE-2026-26986	external
https://bugzilla.suse.com/1258967	external
https://www.suse.com/security/cve/CVE-2026-27951	external
https://bugzilla.suse.com/1258939	external
https://www.suse.com/security/cve/CVE-2026-29775	external
https://bugzilla.suse.com/1259684	external
https://www.suse.com/security/cve/CVE-2026-31883	external
https://bugzilla.suse.com/1259679	external
https://www.suse.com/security/cve/CVE-2026-31884	external
https://bugzilla.suse.com/1259680	external
https://www.suse.com/security/cve/CVE-2026-31885	external
https://bugzilla.suse.com/1259686	external
https://www.suse.com/security/cve/CVE-2026-33985	external
https://bugzilla.suse.com/1261217	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for freerdp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:19358.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:19358.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:19358",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_19358.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:19358",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/005720.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:19358",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/005720.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25952 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25952/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27951 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27951/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-29775 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-29775/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-31883 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-31883/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-31884 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-31884/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-31885 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-31885/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33985 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33985/"
      }
    ],
    "title": "security update for freerdp",
    "tracking": {
      "current_release_date": "2026-09-16T18:18:26Z",
      "generator": {
        "date": "2026-05-19T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:19358",
      "initial_release_date": "2026-05-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-19T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T17:45:18Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:02:16Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:18:26Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.11.7-7.el9_8.3.i686",
                "product": {
                  "name": "freerdp-devel-2:2.11.7-7.el9_8.3.i686",
                  "product_id": "freerdp-devel-2:2.11.7-7.el9_8.3.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-devel@2.11.7-7.el9_8.3?arch=i686\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-7.el9_8.3.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.11.7-7.el9_8.3.i686",
                "product": {
                  "name": "freerdp-libs-2:2.11.7-7.el9_8.3.i686",
                  "product_id": "freerdp-libs-2:2.11.7-7.el9_8.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/freerdp-libs@2.11.7-7.el9_8.3?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.11.7-7.el9_8.3.i686",
                "product": {
                  "name": "libwinpr-2:2.11.7-7.el9_8.3.i686",
                  "product_id": "libwinpr-2:2.11.7-7.el9_8.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr@2.11.7-7.el9_8.3?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
                "product": {
                  "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
                  "product_id": "libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr-devel@2.11.7-7.el9_8.3?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.11.7-7.el9_8.3.x86_64",
                "product": {
                  "name": "freerdp-2:2.11.7-7.el9_8.3.x86_64",
                  "product_id": "freerdp-2:2.11.7-7.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp@2.11.7-7.el9_8.3?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-7.el9_8.3.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
                "product": {
                  "name": "freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
                  "product_id": "freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-devel@2.11.7-7.el9_8.3?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-7.el9_8.3.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
                "product": {
                  "name": "freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
                  "product_id": "freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/freerdp-libs@2.11.7-7.el9_8.3?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.11.7-7.el9_8.3.x86_64",
                "product": {
                  "name": "libwinpr-2:2.11.7-7.el9_8.3.x86_64",
                  "product_id": "libwinpr-2:2.11.7-7.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr@2.11.7-7.el9_8.3?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64",
                  "product_id": "libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr-devel@2.11.7-7.el9_8.3?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.11.7-7.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64"
        },
        "product_reference": "freerdp-2:2.11.7-7.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.11.7-7.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686"
        },
        "product_reference": "freerdp-devel-2:2.11.7-7.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.11.7-7.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64"
        },
        "product_reference": "freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.11.7-7.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686"
        },
        "product_reference": "freerdp-libs-2:2.11.7-7.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.11.7-7.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.11.7-7.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686"
        },
        "product_reference": "libwinpr-2:2.11.7-7.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.11.7-7.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64"
        },
        "product_reference": "libwinpr-2:2.11.7-7.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686"
        },
        "product_reference": "libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-25952",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25952"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25952",
          "url": "https://www.suse.com/security/cve/CVE-2026-25952"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258921 for CVE-2026-25952",
          "url": "https://bugzilla.suse.com/1258921"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-25952"
    },
    {
      "cve": "CVE-2026-26986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26986",
          "url": "https://www.suse.com/security/cve/CVE-2026-26986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258967 for CVE-2026-26986",
          "url": "https://bugzilla.suse.com/1258967"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26986"
    },
    {
      "cve": "CVE-2026-27951",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27951"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `\u003e= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27951",
          "url": "https://www.suse.com/security/cve/CVE-2026-27951"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258939 for CVE-2026-27951",
          "url": "https://bugzilla.suse.com/1258939"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27951"
    },
    {
      "cve": "CVE-2026-29775",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-29775"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP\u0027s bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-29775",
          "url": "https://www.suse.com/security/cve/CVE-2026-29775"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259684 for CVE-2026-29775",
          "url": "https://bugzilla.suse.com/1259684"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-29775"
    },
    {
      "cve": "CVE-2026-31883",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-31883"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-31883",
          "url": "https://www.suse.com/security/cve/CVE-2026-31883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259679 for CVE-2026-31883",
          "url": "https://bugzilla.suse.com/1259679"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-31883"
    },
    {
      "cve": "CVE-2026-31884",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-31884"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context-\u003ecommon.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-31884",
          "url": "https://www.suse.com/security/cve/CVE-2026-31884"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259680 for CVE-2026-31884",
          "url": "https://bugzilla.suse.com/1259680"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-31884"
    },
    {
      "cve": "CVE-2026-31885",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-31885"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-31885",
          "url": "https://www.suse.com/security/cve/CVE-2026-31885"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259686 for CVE-2026-31885",
          "url": "https://bugzilla.suse.com/1259686"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-31885"
    },
    {
      "cve": "CVE-2026-33985",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33985"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
          "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33985",
          "url": "https://www.suse.com/security/cve/CVE-2026-33985"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261217 for CVE-2026-33985",
          "url": "https://bugzilla.suse.com/1261217"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:freerdp-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-devel-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:freerdp-libs-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-2:2.11.7-7.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.i686",
            "SUSE Liberty Linux 9:libwinpr-devel-2:2.11.7-7.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33985"
    }
  ]
}

CVE-2026-25952 (GCVE-0-2026-25952)

Vulnerability from cvelistv5 – Published: 2026-02-25 20:24 – Updated: 2026-02-26 15:56

Title

FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 15:56 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

11 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/1994e98…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25952",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:56:18.815872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:56:24.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T20:24:07.396Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428"
        }
      ],
      "source": {
        "advisory": "GHSA-cgqm-cwjg-7w9x",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25952",
    "datePublished": "2026-02-25T20:24:07.396Z",
    "dateReserved": "2026-02-09T17:13:54.065Z",
    "dateUpdated": "2026-02-26T15:56:24.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26986 (GCVE-0-2026-26986)

Vulnerability from cvelistv5 – Published: 2026-02-25 21:01 – Updated: 2026-09-17 18:36

Title

FreeRDP has heap-use-after-free in rail_window_free

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:35 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

8 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26986",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:35:52.339851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:36:53.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T21:01:16.916Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404"
        }
      ],
      "source": {
        "advisory": "GHSA-crqx-g6x5-rx47",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has heap-use-after-free in rail_window_free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26986",
    "datePublished": "2026-02-25T21:01:16.916Z",
    "dateReserved": "2026-02-17T01:41:24.606Z",
    "dateUpdated": "2026-09-17T18:36:53.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27951 (GCVE-0-2026-27951)

Vulnerability from cvelistv5 – Published: 2026-02-25 21:07 – Updated: 2026-02-25 21:43

Title

FreeRDP has possible Integer overflow in Stream_EnsureCapacity

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-25 21:43 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/118afc0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27951",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-25T21:43:45.822440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-25T21:43:56.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `\u003e= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T21:07:30.828Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113"
        }
      ],
      "source": {
        "advisory": "GHSA-qcfc-ghxr-h927",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has possible Integer overflow in Stream_EnsureCapacity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27951",
    "datePublished": "2026-02-25T21:07:30.828Z",
    "dateReserved": "2026-02-25T03:11:36.690Z",
    "dateUpdated": "2026-02-25T21:43:56.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-29775 (GCVE-0-2026-29775)

Vulnerability from cvelistv5 – Published: 2026-03-13 17:28 – Updated: 2026-03-16 17:04

Title

FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 17:04 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/ffad58f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29775",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T17:04:13.591162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T17:04:16.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP\u0027s bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T17:28:39.641Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f"
        }
      ],
      "source": {
        "advisory": "GHSA-h666-rfw3-jhvj",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29775",
    "datePublished": "2026-03-13T17:28:39.641Z",
    "dateReserved": "2026-03-04T16:26:02.897Z",
    "dateUpdated": "2026-03-16T17:04:16.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31883 (GCVE-0-2026-31883)

Vulnerability from cvelistv5 – Published: 2026-03-13 17:35 – Updated: 2026-03-16 17:02

Title

FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 17:02 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)
CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/16df230…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31883",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T17:02:49.465233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T17:02:52.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T17:35:17.411Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
        }
      ],
      "source": {
        "advisory": "GHSA-85x9-4xxp-xhm5",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31883",
    "datePublished": "2026-03-13T17:35:17.411Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-03-16T17:02:52.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31884 (GCVE-0-2026-31884)

Vulnerability from cvelistv5 – Published: 2026-03-13 17:36 – Updated: 2026-03-16 15:33

Title

FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 15:33 UTC

CWE

CWE-369 - Divide By Zero

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/03b48b3…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/commit/16df230…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31884",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T15:33:39.561333Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T15:33:42.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context-\u003ecommon.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-369",
              "description": "CWE-369: Divide By Zero",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T17:36:57.722Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/03b48b3601d867afccac1cdc6081de7a275edce7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/03b48b3601d867afccac1cdc6081de7a275edce7"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
        }
      ],
      "source": {
        "advisory": "GHSA-jp7m-94ww-p56r",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31884",
    "datePublished": "2026-03-13T17:36:57.722Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-03-16T15:33:42.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31885 (GCVE-0-2026-31885)

Vulnerability from cvelistv5 – Published: 2026-03-13 17:38 – Updated: 2026-03-16 15:32

Title

FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 15:32 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/16df230…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31885",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T15:32:45.417089Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T15:32:48.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T17:38:23.756Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8"
        }
      ],
      "source": {
        "advisory": "GHSA-h23r-3988-3wf3",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31885",
    "datePublished": "2026-03-13T17:38:23.756Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-03-16T15:32:48.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33985 (GCVE-0-2026-33985)

Vulnerability from cvelistv5 – Published: 2026-03-30 21:43 – Updated: 2026-03-31 18:53

Title

FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-31 18:50 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-131 - Incorrect Calculation of Buffer Size

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/c49d1ad…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.24.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33985",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T18:50:32.422828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T18:53:29.979Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131: Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-30T21:43:13.335Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25"
        }
      ],
      "source": {
        "advisory": "GHSA-x6gr-8p7h-5h85",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33985",
    "datePublished": "2026-03-30T21:43:13.335Z",
    "dateReserved": "2026-03-24T22:20:06.211Z",
    "dateUpdated": "2026-03-31T18:53:29.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:19358

CVE-2026-25952 (GCVE-0-2026-25952)

CVE-2026-26986 (GCVE-0-2026-26986)

CVE-2026-27951 (GCVE-0-2026-27951)

CVE-2026-29775 (GCVE-0-2026-29775)

CVE-2026-31883 (GCVE-0-2026-31883)

CVE-2026-31884 (GCVE-0-2026-31884)

CVE-2026-31885 (GCVE-0-2026-31885)

CVE-2026-33985 (GCVE-0-2026-33985)

Tags

Sightings

Nomenclature

Related by attack behaviour