RHSA-2026:94514
Vulnerability from csaf_redhat - Published: 2026-11-03 13:05 - Updated: 2026-11-12 14:12Summary
Red Hat Security Advisory: freerdp security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for freerdp is now available for Red Hat Enterprise Linux 10.2 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)
* freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676)
* freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838)
* freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830)
* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)
* freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833)
* freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839)
* freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378)
* freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379)
* freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381)
* freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382)
* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)
* freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045)
Bug Fix(es) and Enhancement(s):
* Rebase FreeRDP to 3.32.2 or newer [rhel-10.2.z] (JIRA:RHEL-277442)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.
7.1 (High)
Affected products
Fixed
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to cause memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS) through an application crash.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potentially performing unauthorized actions on the host system.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer to be allocated, leading to a heap-based buffer overflow during data read operations.
7.3 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.
7.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager (NTLM) authentication path can result in a Denial of Service (DoS). When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check (MIC) offset. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted authentication message, corrupting heap memory and causing the server to crash.
7.4 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a denial of service (DoS) or memory corruption on a connecting client. This issue occurs because FreeRDP does not properly validate graphical surface dimensions, resulting in an integer overflow during memory allocation calculations. By sending a specially crafted surface creation message, a rogue server can trigger excessive memory consumption or a heap-based buffer overflow, causing the client application to crash.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. In server-side input parsing, the application skips the body of an unknown input event without verifying that the data remains within the declared packet length. A remote attacker with an active session can send a crafted, truncated input event, triggering an internal assertion failure that terminates the server process and causes a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. An out-of-bounds write vulnerability exists in freerdp-proxy when processing Bitmap Cache v2 capability sets. The proxy accepts a client-declared numCellCaches value below five and later indexes the bitmap cache cell array at fixed positions 0 through 4. A client that connects to the proxy and completes capability exchange can cause heap corruption, disclosure of adjacent heap contents to the backend server, or a crash of the proxy process.
8.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A use-after-free vulnerability exists in the client's Remote Desktop Protocol Graphics (RDPGFX) dynamic virtual channel handling. A malicious RDP server can open a second dynamic virtual channel that reuses an already registered channel name with a different ChannelId, overwriting the listener's single callback slot. When that second channel is closed, the callback is freed without clearing the slot. A subsequent PDU on the original channel then dereferences freed memory, which can crash the client or potentially lead to arbitrary code execution.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) and heap memory corruption on the connecting client. This issue occurs in the planar graphics codec because new display dimensions are applied before memory buffer reallocation succeeds. When reallocation fails, the context is not rolled back, allowing subsequent planar drawing commands to write beyond the allocated buffer boundaries and crash the client.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. A use-after-free vulnerability exists in the smartcard emulation feature where a smartcard context is released before its background worker thread is properly terminated. A malicious server can exploit this by sending a crafted sequence of smartcard I/O Request Packets (IRPs) to a client with smartcard redirection enabled. Successful exploitation can corrupt memory or cause the client application to crash, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A double-free memory vulnerability in the Kerberos authentication component allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending a specially crafted Network Level Authentication (NLA) request, an attacker can corrupt server memory and cause the application process to crash.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a race condition in the client by concurrently transmitting graphics reset commands alongside compressed bitmap data. This flaw leads to a use-after-free condition or out-of-bounds memory access on shared graphics decoding buffers. Consequently, an attacker can corrupt client memory, potentially causing the client application to crash resulting in a Denial of Service (DoS) or exposing sensitive memory contents.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) or potentially execute arbitrary code on the client system. An attacker operating a malicious Remote Desktop Protocol (RDP) server, or acting in a man-in-the-middle position, can exploit this issue by sending specially crafted graphics pipeline commands. This occurs due to improper surface key truncation, causing an internal table to become inconsistent and triggering a heap-based buffer overflow when data is written past allocated memory boundaries.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop (RD) Gateway or network attacker can cause a Denial of Service (DoS) by sending a truncated WebSocket data frame followed by a Transport Layer Security (TLS) connection shutdown. Due to improper handling of the incomplete payload when the connection closes, the client enters an infinite loop, consuming excessive Central Processing Unit (CPU) resources until the application is terminated.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted Credential Security Support Provider (CredSSP) request that omits negotiation tokens. When processing this malformed request with Network Level Authentication (NLA) enabled, the server triggers an internal assertion failure that abruptly terminates the server process and drops active client sessions.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol (RDP) server can trigger a race condition by repeatedly requesting the creation of an already active dynamic virtual channel while client data is concurrently processed. This issue leads to a use-after-free condition, allowing the server to crash the proxy process and result in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) or memory corruption by sending fragmented responses during Early User Authorization (EUA) authentication. Because FreeRDP fails to properly track remaining buffer space across partial network reads, incoming data advances past the allocated memory boundaries. An attacker who successfully exploits this issue triggers an out-of-bounds memory write, crashing the client application.
8.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the client application. By sending audio data packets over a dynamic virtual channel and immediately closing the connection, the server triggers a use-after-free condition where the client's audio playback thread accesses already released memory.
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Moderate
A flaw was found in FreeRDP. A compromised or malicious Remote Desktop (RD) Gateway server can send specially crafted Remote Procedure Call (RPC) network messages to a connecting client. Because the client verifies total buffer capacity instead of remaining buffer space before writing incoming data, client heap memory can be overwritten. An attacker can exploit this flaw to potentially execute arbitrary code or crash the client application, resulting in a Denial of Service (DoS).
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-109242
Threats
Impact
Important
References
214 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for freerdp is now available for Red Hat Enterprise Linux 10.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)\n\n* freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676)\n\n* freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838)\n\n* freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830)\n\n* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)\n\n* freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833)\n\n* freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839)\n\n* freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378)\n\n* freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379)\n\n* freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381)\n\n* freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382)\n\n* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)\n\n* freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase FreeRDP to 3.32.2 or newer [rhel-10.2.z] (JIRA:RHEL-277442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:94514",
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2549790",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549790"
},
{
"category": "external",
"summary": "2550539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550539"
},
{
"category": "external",
"summary": "2552961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552961"
},
{
"category": "external",
"summary": "2552970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552970"
},
{
"category": "external",
"summary": "2552978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552978"
},
{
"category": "external",
"summary": "2552988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552988"
},
{
"category": "external",
"summary": "2552996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552996"
},
{
"category": "external",
"summary": "2553907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553907"
},
{
"category": "external",
"summary": "2553911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553911"
},
{
"category": "external",
"summary": "2553917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553917"
},
{
"category": "external",
"summary": "2553920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553920"
},
{
"category": "external",
"summary": "2554625",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554625"
},
{
"category": "external",
"summary": "2557974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557974"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94514.json"
}
],
"title": "Red Hat Security Advisory: freerdp security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-11-12T14:12:44+00:00",
"generator": {
"date": "2026-11-12T14:12:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:94514",
"initial_release_date": "2026-11-03T13:05:30+00:00",
"revision_history": [
{
"date": "2026-11-03T13:05:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-03T13:05:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-12T14:12:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-libs-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_2.s390x",
"product_id": "libwinpr-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-devel-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_2.s390x",
"product_id": "freerdp-server-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_2?arch=s390x\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_2.src",
"product": {
"name": "freerdp-2:3.32.2-1.el10_2.src",
"product_id": "freerdp-2:3.32.2-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_2?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_2.aarch64",
"product_id": "libwinpr-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_2.aarch64",
"product_id": "freerdp-server-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_2?arch=aarch64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_2.ppc64le",
"product_id": "libwinpr-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"product_id": "freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_2?arch=ppc64le\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_2.x86_64",
"product_id": "libwinpr-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_2.x86_64",
"product_id": "freerdp-server-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_2.x86_64",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.x86_64",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_2?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src"
},
"product_reference": "freerdp-2:3.32.2-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-109242",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-10-12T16:50:24.134372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2549790"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Moderate because a compromised or malicious remote desktop endpoint can trigger an unhandled crash or leak uninitialized process memory to the client display without requiring privileges. In Red Hat Enterprise Linux, FreeRDP packages are primarily utilized to establish outbound remote desktop sessions, meaning exposure depends on connecting to an untrusted server. While the attack occurs over the network, exploitation relies on user interaction to initiate the connection to a rogue host rather than exposing a continuously listening network service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109242"
},
{
"category": "external",
"summary": "RHBZ#2549790",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549790"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109242"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109242",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109242"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade"
}
],
"release_date": "2026-10-12T16:04:18.336000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling"
},
{
"cve": "CVE-2026-109676",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-13T13:58:50.614349+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to cause memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS) through an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because a malicious RDP peer can trigger memory corruption in the FreeRDP client after the user connects (UI:R), with potential impact beyond a simple crash. Red Hat heap/allocator hardening and ASLR raise exploitation difficulty but do not justify lowering Confidentiality/Integrity/Availability in the base score when corruption is confirmed. This is the highest-severity issue in this FreeRDP set (CVSS 8.8) but remains Important rather than Critical because exploitation requires the user to connect to a malicious RDP server (UI:R).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109676"
},
{
"category": "external",
"summary": "RHBZ#2550539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109676"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect"
}
],
"release_date": "2026-10-13T13:27:05.624000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect"
},
{
"cve": "CVE-2026-110830",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-10-14T23:01:57.961596+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat Enterprise Linux because the impact is confined to client-side denial of service and requires an explicit, non-default feature configuration. FreeRDP does not enable serial device redirection by default, meaning an attacker-controlled RDP server can only trigger descriptor exhaustion if the client session specifically opted into serial forwarding. Additionally, the flaw affects only availability without impacting system confidentiality or data integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110830"
},
{
"category": "external",
"summary": "RHBZ#2552970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110830"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-denial-of-service-via-serial-irp-mj-create",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-denial-of-service-via-serial-irp-mj-create"
}
],
"release_date": "2026-10-14T22:52:05.434000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling"
},
{
"cve": "CVE-2026-110833",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-10-14T23:03:24.773509+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552988"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an established session with device redirection and a proxy explicitly configured to intercept RDPDR channel traffic, resulting in resource exhaustion without compromising data integrity, confidentiality, or allowing arbitrary code execution. In standard Red Hat deployments, FreeRDP is predominantly utilized as a client application or library rather than an intermediary proxy service. Consequently, typical environments are not exposed to this issue unless the proxy is actively deployed with channel interception enabled. Furthermore, Red Hat Enterprise Linux 8 and 9 are unaffected because they provide earlier FreeRDP versions lacking the vulnerable proxy code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110833"
},
{
"category": "external",
"summary": "RHBZ#2552988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110833"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-unbounded-memory-retention-via-rdpdr-proxy",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-unbounded-memory-retention-via-rdpdr-proxy"
}
],
"release_date": "2026-10-14T22:52:08.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly"
},
{
"cve": "CVE-2026-110837",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-10-14T23:02:39.532885+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552978"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because crafted MP3 audio from a malicious RDP server can cause a heap buffer overflow in the client after the user connects (UI:R), with integrity and availability impact and limited confidentiality impact (CVSS 7.1). Decode-path constraints keep Attack Complexity High. Allocator hardening may impede exploitation but does not clear I:H/A:H.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110837"
},
{
"category": "external",
"summary": "RHBZ#2552978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552978"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110837"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110837",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110837"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding"
}
],
"release_date": "2026-10-14T22:52:12.464000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding"
},
{
"cve": "CVE-2026-110838",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Functionality"
},
"discovery_date": "2026-10-14T23:01:12.986657+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user\u0027s active session, potentially performing unauthorized actions on the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as Important because an unauthenticated remote attacker with network access to a running shadow server can bypass authentication checks and inject synthetic keystrokes directly into an active graphical session. This issue specifically affects environments using FreeRDP 3, which is included in Red Hat Enterprise Linux 10, whereas earlier enterprise versions utilizing FreeRDP 2 do not contain the vulnerable state-machine code. Overall exposure is limited on standard systems because the FreeRDP shadow daemon is not active by default and requires explicit execution by an administrator or user.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110838"
},
{
"category": "external",
"summary": "RHBZ#2552961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110838"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110838",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110838"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass",
"url": "https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass"
}
],
"release_date": "2026-10-14T22:52:13.434000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Do not expose freerdp-shadow-cli to untrusted networks. Restrict access with host firewalling and require authentication.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch"
},
{
"cve": "CVE-2026-110839",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-14T23:04:05.291392+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because a malicious RDP endpoint can trigger a heap out-of-bounds write during JPEG clipboard conversion after the user connects (UI:R), impacting integrity and availability (CVSS 7.1). Platform hardening may impede reliable exploitation but does not remove I:L/A:H from the base score.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110839"
},
{
"category": "external",
"summary": "RHBZ#2552996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110839"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data",
"url": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data"
}
],
"release_date": "2026-10-14T22:52:14.540000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "If clipboard redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion"
},
{
"cve": "CVE-2026-111378",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-16T01:40:56.515294+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553907"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having an Important impact because an unauthenticated remote attacker can exhaust server memory prior to authentication without requiring valid user credentials or privileges. While FreeRDP packages in Red Hat Enterprise Linux are primarily utilized for client-side connectivity, server implementations and services utilizing FreeRDP server libraries with Network Level Authentication are exposed to denial of service from unbounded buffer growth. Deployments that solely execute FreeRDP as an outbound client remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111378"
},
{
"category": "external",
"summary": "RHBZ#2553907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553907"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111378"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111378",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111378"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser"
}
],
"release_date": "2026-10-16T01:17:46.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required.\n\n1. Restrict RDP access to trusted network sources using firewalld:\n# firewall-cmd --permanent --zone=public --remove-service=rdp\n# firewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_IP_or_CIDR\u003e\n# firewall-cmd --reload\n\n2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop):\n# systemctl --user --now mask gnome-remote-desktop.service\n\nCaveats and Warnings:\nReloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser"
},
{
"cve": "CVE-2026-111379",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:10.685620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553911"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer to be allocated, leading to a heap-based buffer overflow during data read operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An important-severity heap-based buffer overflow was found in FreeRDP\u0027s persistent bitmap cache handling. When FreeRDP loads a persistent cache file, an integer wraparound in the size calculation in persist_cache_get_data, triggered by large attacker-controlled width and height values in a crafted v3 persistent cache file, causes an undersized buffer to be allocated, which is then overflowed when the entry is read in persistent_cache_read_entry_v3. A local attacker who can place a crafted persistent cache file and have it loaded by a user could use this flaw to crash the FreeRDP client or potentially execute arbitrary code in the context of the client process. The freerdp component is affected as shipped in multiple Red Hat Enterprise Linux versions, in Red Hat In-Vehicle OS, and in the Fedora and EPEL community streams, where a fix is being pursued; the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 score of 7.3, consistent with the upstream severity assessment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111379"
},
{
"category": "external",
"summary": "RHBZ#2553911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111379"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3"
}
],
"release_date": "2026-10-16T01:17:47.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file"
},
{
"cve": "CVE-2026-111381",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:32.679134+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553917"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Arbitrary code execution via crafted persistent cache file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow was found in FreeRDP\u0027s persistent cache v2 parser (persistent_cache_read_entry_v2 in libfreerdp/cache/persistent.c). An integer wraparound in the bitmap size calculation allows a crafted persistent cache v2 file containing oversized width and height values to bypass bounds checks, causing mismatched entry size accounting and fixed 16 KiB reads that corrupt heap memory. A local attacker can exploit this flaw by convincing a user to load a maliciously crafted persistent cache file, resulting in a crash of the FreeRDP client or potential arbitrary code execution in the context of the user running the client. Red Hat rates this flaw as IMPORTANT (CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream Important rating, with exploitation requiring user interaction to load the attacker-supplied cache file. The freerdp package as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10, freerdp and freerdp2 in Red Hat In-Vehicle OS, and freerdp and freerdp2 in Fedora and EPEL are affected, and fixes for these products are being pursued.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111381"
},
{
"category": "external",
"summary": "RHBZ#2553917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111381"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111381",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111381"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser"
}
],
"release_date": "2026-10-16T01:17:50.516000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Arbitrary code execution via crafted persistent cache file"
},
{
"cve": "CVE-2026-111382",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:50.190968+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553920"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Arbitrary code execution via crafted display frames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because successful exploitation could allow a remote server to execute arbitrary code within the privileges of the connecting client user, rather than affecting the underlying system with elevated privileges. Within Red Hat Enterprise Linux, FreeRDP functions as a client application and library for Remote Desktop Protocol sessions. The flaw is not directly exploitable over the network unless a local user or automated service actively initiates a connection to an untrusted or malicious endpoint. Environments that do not establish outbound RDP connections are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111382"
},
{
"category": "external",
"summary": "RHBZ#2553920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111382"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-out-of-bounds-write-in-avc444-yuv444-combine",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-out-of-bounds-write-in-avc444-yuv444-combine"
}
],
"release_date": "2026-10-16T01:17:51.334000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Arbitrary code execution via crafted display frames"
},
{
"cve": "CVE-2026-111880",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-17T19:02:09.270418+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2554625"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager (NTLM) authentication path can result in a Denial of Service (DoS). When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check (MIC) offset. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted authentication message, corrupting heap memory and causing the server to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is reachable only on FreeRDP server or proxy peers that configure the non-default SspiNtlmHashCallback NTLM hash callback, which is reflected as Attack Complexity: High. An unauthenticated network attacker can cause a fixed 16-byte out-of-bounds heap write, so Integrity and Availability are High; Confidentiality is None. Red Hat rates this Important. Platform safeguards such as ASLR, NX, FORTIFY_SOURCE, and glibc allocator hardening may impede reliable code execution, but they do not prevent the out-of-bounds write or process crash, so the base metrics are unchanged.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111880"
},
{
"category": "external",
"summary": "RHBZ#2554625",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554625"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111880"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111880",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111880"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset"
}
],
"release_date": "2026-10-17T18:46:08.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Do not expose FreeRDP server or proxy endpoints that use SspiNtlmHashCallback to untrusted networks; restrict access with a host firewall and network segmentation. If the NTLM hash callback is not required, leave it unset so the vulnerable MIC path is not entered.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds validation on Message Integrity Check (MIC) offsets within the authenticate message buffer before writing in ntlm_computeMicValue: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which validate that the MIC offset is within the authenticate message buffer bounds before writing bytes, closing crafted NTLM AUTHENTICATE_MESSAGE with backward session-key offset and out-of-bounds MIC offset. Until patched, this is a concern on FreeRDP server and proxy instances configured with the non-default SspiNtlmHashCallback setting, so leave SspiNtlmHashCallback unset if NTLM hash callbacks are not required, and restrict network access to FreeRDP endpoints from untrusted networks using firewalls and network segmentation. As a compensating measure, configure systemd service restart and watchdog settings to automatically restart FreeRDP upon process crashes and mitigate prolonged denial of service, require pre-authentication through a zero-trust gateway or identity-aware proxy before clients can reach the FreeRDP NTLM authentication handler, and restrict FreeRDP port access with host firewalls using firewalld or nftables to isolate the service from untrusted networks. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds write defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication"
},
{
"cve": "CVE-2026-114045",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-10-21T00:55:40.781083+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557974"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important because an authenticated RDP client can trigger a heap-based buffer overflow in the FreeRDP server audio (rdpsnd) channel without further user interaction (PR:L, UI:N), with High impact on confidentiality, integrity, and availability. The vulnerable code is in the server-side rdpsnd path shipped when FreeRDP server components (for example freerdp-server / freerdp-shadow-cli) are built and used. Red Hat products that ship FreeRDP with server support before 3.32.1 are affected. Platform hardening such as ASLR, NX, and FORTIFY_SOURCE may make reliable exploitation more difficult but does not remove the underlying memory-corruption risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114045"
},
{
"category": "external",
"summary": "RHBZ#2557974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557974"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114045"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114045",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114045"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format"
}
],
"release_date": "2026-10-21T00:36:24.094000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "If FreeRDP server or shadow components are unused, remove or disable them.\nRestrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats"
},
{
"cve": "CVE-2026-121386",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-11-03T15:12:43.602610+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact for Red Hat products because an untrusted remote desktop host or network intermediary can terminate the client session unexpectedly without prior authentication. Although this defect causes application termination rather than remote code execution, it directly impacts the availability of user sessions in enterprise environments. Exploitation requires an established connection to a malicious RDP endpoint or interception by an adversary on the network path processing shared clipboard content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121386"
},
{
"category": "external",
"summary": "RHBZ#2565870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121386"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers"
}
],
"release_date": "2026-11-03T14:27:53.842000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Disable clipboard redirection for RDP connections.\n\nWhen launching sessions with the xfreerdp command-line utility, explicitly disable the clipboard channel:\n```\nxfreerdp -clipboard /v:\u003cserver_address\u003e\n```\n\nWhen connecting via graphical clients, disable clipboard synchronization within the respective connection profile preferences.\n\nCaveats:\nDisabling clipboard redirection prevents transferring text, images, or files between the local system and the remote session.\n\nWarning:\nChanges apply to new connections; any active RDP sessions must be disconnected and restarted for the setting to take effect.\n\n--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to disable clipboard redirection in FreeRDP client connections to prevent processing untrusted image buffers through WinPR: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which install setjmp error handlers for libpng and libjpeg in winpr_read_png_from_buffer, winpr_convert_from_jpeg, and winpr_convert_to_jpeg, closing all 2 injection vectors (malformed PNG clipboard payload, truncated JPEG clipboard payload). Until patched, this is a concern on FreeRDP client sessions with clipboard redirection enabled connecting across untrusted networks or to untrusted RDP servers, so Disable clipboard redirection by using the -clipboard flag in xfreerdp or disabling clipboard synchronization in graphical connection profiles, then disconnect and restart active sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing image library error-handling defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads"
},
{
"cve": "CVE-2026-121388",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-11-03T16:55:30.875628+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565959"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can exhaust client memory by sending DRDYNVC DATA_FIRST messages with an oversized length field, resulting in a denial of service. The user must connect to an attacker-controlled server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121388"
},
{
"category": "external",
"summary": "RHBZ#2565959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565959"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121388"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first"
}
],
"release_date": "2026-11-03T14:27:55.216000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels"
},
{
"cve": "CVE-2026-121394",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-11-03T16:58:36.652636+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted packet triggering an assertion failure in the RemoteFX decoder, resulting in a denial of service. The user must connect to an attacker-controlled server and RemoteFX must be enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121394"
},
{
"category": "external",
"summary": "RHBZ#2565962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121394"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121394",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121394"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder"
}
],
"release_date": "2026-11-03T14:27:59.158000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder"
},
{
"cve": "CVE-2026-121402",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-11-03T16:45:41.194137+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via zero-width graphics reset",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted zero-width graphics reset that triggers a NULL pointer dereference, resulting in a denial of service. The user must connect to an attacker-controlled server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121402"
},
{
"category": "external",
"summary": "RHBZ#2565949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121402"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121402",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121402"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics"
}
],
"release_date": "2026-11-03T14:28:04.673000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via zero-width graphics reset"
},
{
"cve": "CVE-2026-121404",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-11-03T16:46:02.560516+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. An attacker controlling an RDP server can cause a connected FreeRDP client to spin indefinitely by sending zero-length dynamic virtual channel messages, resulting in a denial of service. An authenticated RDP session is required.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121404"
},
{
"category": "external",
"summary": "RHBZ#2565951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121404"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data"
}
],
"release_date": "2026-11-03T14:28:06.089000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages"
},
{
"cve": "CVE-2026-121950",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-11-05T22:13:16.265095+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567633"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a denial of service (DoS) or memory corruption on a connecting client. This issue occurs because FreeRDP does not properly validate graphical surface dimensions, resulting in an integer overflow during memory allocation calculations. By sending a specially crafted surface creation message, a rogue server can trigger excessive memory consumption or a heap-based buffer overflow, causing the client application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Heap buffer overflow via integer overflow in surface creation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as Moderate impact for Red Hat products because exploitation requires client-side user interaction to connect to an untrusted remote system, restricting the potential blast radius to the local application session. On standard 64-bit Red Hat Enterprise Linux architectures, the arithmetic wrap does not occur; instead, the oversized dimension request triggers an excessively large memory allocation that terminates the client process rather than corrupting memory. As a result, an attacker is limited to causing a denial of service on the client without compromising host system integrity or achieving arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121950"
},
{
"category": "external",
"summary": "RHBZ#2567633",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567633"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121950"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f53w-3364-jr35",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f53w-3364-jr35"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-overflow-via-rdpgfx-create-surface-integer-wrap",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-overflow-via-rdpgfx-create-surface-integer-wrap"
}
],
"release_date": "2026-11-04T15:33:16.620000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "To mitigate this restrict outbound client connections strictly to trusted RDP servers and enforce memory limits via OS process resource limits or cgroups v2 to prevent multi-gigabyte memory exhaustion on 64-bit hosts. On 32-bit or sensitive environments, ensure ASLR and glibc heap allocator hardening are active to mitigate heap corruption risks.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: FreeRDP: Heap buffer overflow via integer overflow in surface creation"
},
{
"cve": "CVE-2026-121951",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-11-05T22:06:17.716522+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567548"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. In server-side input parsing, the application skips the body of an unknown input event without verifying that the data remains within the declared packet length. A remote attacker with an active session can send a crafted, truncated input event, triggering an internal assertion failure that terminates the server process and causes a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via truncated input event",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important because a remote client can trigger an unhandled process abort, resulting in a complete denial of service across active sessions on the server process. In standard Red Hat Enterprise Linux environments, FreeRDP packages are primarily utilized for client-side remote desktop connectivity, which remains unaffected by this server-side defect. Exposure is limited to configurations that explicitly run FreeRDP server instances or shadow services reachable by untrusted clients.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121951"
},
{
"category": "external",
"summary": "RHBZ#2567548",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567548"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121951"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121951",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121951"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-slow-path-input-event",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-slow-path-input-event"
}
],
"release_date": "2026-11-04T15:33:17.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict exposure by limiting RDP network traffic to trusted hosts or subnets using firewalld:\n\n1. Add the trusted administrative subnet to the trusted zone:\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\n\n2. Remove general access to the RDP port (default 3389/tcp) from public zones:\nfirewall-cmd --permanent --zone=public --remove-port=3389/tcp\n\n3. Apply the firewall configuration:\nfirewall-cmd --reload\n\nWarning: Reloading firewall rules may briefly interrupt active network sessions.\n\nAdditionally, stop any running `freerdp-shadow-cli` or custom FreeRDP server processes if remote session sharing is not actively required.\n\nCaveat: Network access controls mitigate untrusted exposure but do not defend against malicious input sent by authorized clients within the permitted network.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate remaining stream length before advancing stream pointers in FreeRDP server-side slow-path input parsing: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which verify remaining packet length before seeking past the six-byte body of an unknown input event, closing truncated slow-path input event with unknown message type. Until patched, this is only a concern on configurations running FreeRDP server instances or shadow services compiled with active WinPR assertions \u2014 client-side FreeRDP connections are unaffected \u2014 so restrict network access to RDP listening ports to trusted hosts using firewall rules or disable running freerdp-shadow-cli and custom server processes. These controls limit blast radius and contain exploitation, but they do not fix the underlying reachable assertion failure defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via truncated input event"
},
{
"cve": "CVE-2026-121952",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-05T22:34:42.453635+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567902"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An out-of-bounds write vulnerability exists in freerdp-proxy when processing Bitmap Cache v2 capability sets. The proxy accepts a client-declared numCellCaches value below five and later indexes the bitmap cache cell array at fixed positions 0 through 4. A client that connects to the proxy and completes capability exchange can cause heap corruption, disclosure of adjacent heap contents to the backend server, or a crash of the proxy process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Out-of-bounds write in proxy bitmap cache v2 capability handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important rather than Critical. A remote client can trigger memory corruption in freerdp-proxy without additional user interaction on the proxy host, but freerdp-proxy is not enabled or exposed by default and must be deliberately deployed. Turning the constrained out-of-bounds write into reliable arbitrary code execution depends on heap layout and a fully established proxy path to a backend server. Confirmed impacts include proxy process crash and potential heap content leakage to the backend. This Important rating aligns with the upstream High severity advisory rather than a Critical network-service compromise on a default Red Hat deployment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121952"
},
{
"category": "external",
"summary": "RHBZ#2567902",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567902"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121952",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121952"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121952",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121952"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-proxy-out-of-bounds-write-via-bitmap-cache-v2-capability",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-proxy-out-of-bounds-write-via-bitmap-cache-v2-capability"
}
],
"release_date": "2026-11-04T15:33:18.074000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "If freerdp-proxy is not required, do not run it. Where proxy use is necessary, restrict listening access to trusted client networks and require client authentication.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce minimum bounds validation on client-declared numCellCaches before allocating the bitmap cache array in freerdp-proxy: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which reject Bitmap Cache v2 capability sets declaring numCellCaches values below five, closing all 2 injection vectors (Crafted Confirm Active PDU declaring numCellCaches below five, Bitmap Cache v2 capability with persistent keys enabled). Until patched, this is a concern on Deployments running the freerdp-proxy component accessible to network clients, so Disable freerdp-proxy if not required, or restrict network access to trusted client networks and enforce client authentication. As a compensating measure, Enable Address Space Layout Randomization to randomize proxy memory layout and hinder reliable heap exploitation, Enforce full RELRO and PIE on the freerdp-proxy binary to prevent Global Offset Table overwrites, and Enable Control Flow Integrity to restrict indirect branch targets to valid functions if heap metadata is corrupted. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds heap write defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Out-of-bounds write in proxy bitmap cache v2 capability handling"
},
{
"cve": "CVE-2026-121953",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-11-05T22:37:44.713124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567941"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A use-after-free vulnerability exists in the client\u0027s Remote Desktop Protocol Graphics (RDPGFX) dynamic virtual channel handling. A malicious RDP server can open a second dynamic virtual channel that reuses an already registered channel name with a different ChannelId, overwriting the listener\u0027s single callback slot. When that second channel is closed, the callback is freed without clearing the slot. A subsequent PDU on the original channel then dereferences freed memory, which can crash the client or potentially lead to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Use-after-free via rdpgfx dynamic virtual channel close",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important rather than Critical because exploitation requires a user to initiate a connection to a malicious or compromised RDP server. Once connected with the graphics pipeline enabled, a hostile server can trigger a use-after-free in the FreeRDP client process that may allow code execution with the privileges of the client user. Standard Red Hat Enterprise Linux hardening such as ASLR, NX, FORTIFY_SOURCE, and glibc allocator protections may impede reliable code execution but does not remove the denial-of-service impact from a client crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121953"
},
{
"category": "external",
"summary": "RHBZ#2567941",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567941"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121953"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121953",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121953"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-dynamic-virtual-channel-close",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-dynamic-virtual-channel-close"
}
],
"release_date": "2026-11-04T15:33:18.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict FreeRDP client connections to trusted RDP servers and enforce server certificate verification. Avoid connecting to untrusted remote desktop endpoints.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Use-after-free via rdpgfx dynamic virtual channel close"
},
{
"cve": "CVE-2026-121954",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-05T22:11:46.465583+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567613"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) and heap memory corruption on the connecting client. This issue occurs in the planar graphics codec because new display dimensions are applied before memory buffer reallocation succeeds. When reallocation fails, the context is not rolled back, allowing subsequent planar drawing commands to write beyond the allocated buffer boundaries and crash the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in planar codec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having a Moderate severity because successful exploitation requires user interaction to initiate a remote desktop session to an untrusted or compromised server, rather than targeting an exposed listening network service. While processing manipulated graphics display commands can lead to client-side memory corruption, the demonstrated impact is confined to terminating the client session via a crash. Server deployments of FreeRDP and sessions established solely with trusted remote hosts do not face exposure from arbitrary remote attackers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121954"
},
{
"category": "external",
"summary": "RHBZ#2567613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567613"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121954"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121954",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121954"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fg78-v8j5-8697",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fg78-v8j5-8697"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-out-of-bounds-write-in-planar-codec",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-out-of-bounds-write-in-planar-codec"
}
],
"release_date": "2026-11-04T15:33:19.513000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "To mitigate this restrict outbound client connections strictly to trusted RDP servers and contain client-side execution with OS sandboxing or Mandatory Access Control such as SELinux, AppArmor, or Landlock. Ensure ASLR and glibc heap allocator hardening are enabled to reduce the likelihood of reliable heap exploitation on affected clients.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in planar codec"
},
{
"cve": "CVE-2026-121955",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-05T22:08:10.472566+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567569"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A use-after-free vulnerability exists in the smartcard emulation feature where a smartcard context is released before its background worker thread is properly terminated. A malicious server can exploit this by sending a crafted sequence of smartcard I/O Request Packets (IRPs) to a client with smartcard redirection enabled. Successful exploitation can corrupt memory or cause the client application to crash, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via use-after-free in smartcard emulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an untrusted RDP server can remotely cause application crashes or heap corruption without requiring elevated privileges. The flaw affects client sessions where smartcard device redirection and emulation are actively configured, which is not engaged during standard RDP connections. In typical environments where smartcard forwarding is unused, client systems remain unaffected by this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121955"
},
{
"category": "external",
"summary": "RHBZ#2567569",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567569"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121955"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121955",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121955"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-983v-jp34-f3fm",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-983v-jp34-f3fm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-in-smartcard-emulation-releasecontext",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-in-smartcard-emulation-releasecontext"
}
],
"release_date": "2026-11-04T15:33:20.216000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Do not enable smartcard redirection when establishing FreeRDP sessions.\n\nEnsure client connection profiles and command-line invocations omit the `/smartcard` parameter (for example, launch connections using `xfreerdp /v:\u003cserver_address\u003e` without the `/smartcard` switch). In graphical connection managers or RDP configuration files, disable smartcard forwarding. Additionally, only establish RDP sessions to trusted endpoints.\n\nCaveats: Omitting smartcard redirection prevents the use of smartcard hardware tokens and smartcard-based authentication within the remote session.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to cancel and join the background worker thread prior to freeing the emulated SCardContext in FreeRDP smartcard emulation: upgrade to FreeRDP 3.32.2+ (or the fixed Freerdp builds), which cancel and join the background worker thread before freeing the emulated SCardContext in Emulate_SCardReleaseContext, closing crafted sequence of smartcard IRPs containing ESTABLISHCONTEXT, long-timeout GETSTATUSCHANGE, and RELEASECONTEXT. Until patched, this is a concern on FreeRDP client sessions with smartcard redirection and smartcard emulation enabled, so Omit the /smartcard parameter from connection profiles and command-line invocations, disable smartcard forwarding in connection managers, and only establish RDP sessions to trusted endpoints. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via use-after-free in smartcard emulation"
},
{
"cve": "CVE-2026-121956",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-11-05T22:37:36.693072+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567939"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A double-free memory vulnerability in the Kerberos authentication component allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending a specially crafted Network Level Authentication (NLA) request, an attacker can corrupt server memory and cause the application process to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via crafted Kerberos authentication request",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated with an Important severity rating because an unauthenticated remote attacker can trigger a denial of service or heap corruption across the network before establishing credentials. In Red Hat enterprise environments, FreeRDP packages are primarily utilized as client-side software rather than listening services, which significantly reduces the exposed attack surface on typical installations. Exploitation specifically requires an active FreeRDP server or proxy configured with Kerberos authentication, an associated keytab, and an enabled user-to-user negotiation mechanism, limiting the likelihood of widespread exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121956"
},
{
"category": "external",
"summary": "RHBZ#2567939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121956"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2557-79qc-6gfr",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2557-79qc-6gfr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-double-free-in-winpr-kerberos-retrievesometgt",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-double-free-in-winpr-kerberos-retrievesometgt"
}
],
"release_date": "2026-11-04T15:33:20.931000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict network exposure by limiting incoming connections to trusted IP addresses or networks using `firewalld`, or disable the listening RDP service if remote desktop access is not required.\n\nTo restrict RDP access to a trusted subnet using `firewalld`:\n\n```\nfirewall-cmd --permanent --remove-service=rdp\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --reload\n```\n\nWarning: Reloading firewall rules may temporarily interrupt existing network sessions and will prevent incoming RDP connections originating from outside the designated trusted subnets.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to ensure proper memory ownership or duplication of default Kerberos realm strings within the WinPR Kerberos SSPI retrieveSomeTgt routine during target principal assignment: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which duplicate or properly manage ownership of the default Kerberos realm string when assigning it to a realm-less target principal, closing crafted NLA/CredSSP u2u TGT request containing an \u0027@\u0027 in the server-name component. Until patched, this is only a concern on FreeRDP servers or proxies configured with Kerberos authentication and user-to-user negotiation \u2014 Client-only FreeRDP installations or servers without Kerberos and u2u negotiation enabled are unaffected \u2014 so Restrict incoming network connections to the RDP listening port to trusted IP addresses using firewall rules, or disable the listening RDP service and user-to-user negotiation. These controls limit blast radius and contain exploitation, but they do not fix the underlying double-free defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via crafted Kerberos authentication request"
},
{
"cve": "CVE-2026-121957",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-05T22:04:09.178683+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567521"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a race condition in the client by concurrently transmitting graphics reset commands alongside compressed bitmap data. This flaw leads to a use-after-free condition or out-of-bounds memory access on shared graphics decoding buffers. Consequently, an attacker can corrupt client memory, potentially causing the client application to crash resulting in a Denial of Service (DoS) or exposing sensitive memory contents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as an Important severity because an untrusted endpoint can compromise client memory integrity and potentially execute arbitrary code with the privileges of the user running the session. A client system is vulnerable only when initiating a connection to an attacker-controlled remote desktop server that transmits conflicting display pipeline instructions. Although triggering this synchronization defect requires specific timing and client-initiated interaction, successful exploitation directly compromises the security boundaries of the client system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121957"
},
{
"category": "external",
"summary": "RHBZ#2567521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567521"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121957"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121957",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121957"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race"
}
],
"release_date": "2026-11-04T15:33:21.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to synchronize access and establish mutual exclusion between the drdynvc RDPGFX ResetGraphics handler and the main thread planar bitmap decoder on shared planar buffers: upgrade to FreeRDP 3.32.2+ (or the fixed Freerdp builds), which synchronizes the drdynvc ResetGraphics path and planar decode routines sharing the planar context to prevent concurrent buffer reallocations during active decoding, closing concurrent RDPGFX ResetGraphics messages and compressed planar bitmap updates. Until patched, this is a concern on FreeRDP client installations connecting to remote RDP servers across any platform, so Restrict outbound RDP client connections to trusted, verified servers and block connections to unknown or untrusted remote desktop endpoints. As a compensating measure, Enable Address Space Layout Randomization to randomize FreeRDP process memory layout and hinder reliable code execution from heap corruption and Enable glibc safe-linking and heap metadata protection to impede heap manipulation and tcache corruption during planar buffer use-after-free exploitation. These controls limit blast radius and contain exploitation, but they do not fix the underlying race condition use-after-free defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding"
},
{
"cve": "CVE-2026-121958",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-11-05T22:12:55.855904+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) or potentially execute arbitrary code on the client system. An attacker operating a malicious Remote Desktop Protocol (RDP) server, or acting in a man-in-the-middle position, can exploit this issue by sending specially crafted graphics pipeline commands. This occurs due to improper surface key truncation, causing an internal table to become inconsistent and triggering a heap-based buffer overflow when data is written past allocated memory boundaries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Heap-based buffer overflow via surface key truncation in RDPGFX",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an untrusted or compromised remote desktop server can trigger heap memory corruption in the client process, potentially leading to arbitrary code execution or application crash. To exploit this flaw, a user must actively establish a remote desktop connection to a rogue server or have their traffic intercepted by a malicious intermediary. Red Hat Enterprise Linux systems acting purely as remote desktop servers or that do not initiate outbound connections to untrusted endpoints are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121958"
},
{
"category": "external",
"summary": "RHBZ#2567629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121958"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121958",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121958"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m59q-wm7v-mp57",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m59q-wm7v-mp57"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-through-3.32.1-heap-out-of-bounds-write-via-rdpgfx-hashtable-getkeys",
"url": "https://www.vulncheck.com/advisories/freerdp-through-3.32.1-heap-out-of-bounds-write-via-rdpgfx-hashtable-getkeys"
}
],
"release_date": "2026-11-04T15:33:22.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict FreeRDP client connections to verified RDP endpoints, enforce network encryption against interception, and disable the RDPGFX dynamic virtual channel in client configurations. As a compensating measure, Randomize process memory layouts with ASLR to impede reliable arbitrary code execution, Enforce full RELRO and PIE to protect the Global Offset Table from overwrites during heap corruption exploitation, Enable Control Flow Integrity to validate indirect call targets and block control-flow hijacking, Deploy EDR agents to detect anomalous post-exploitation behaviors and child processes spawned by FreeRDP, and Enforce non-executable memory protections using the NX/XD bit to block execution of shellcode in heap pages. Please apply the fix when available.t CME: CME-101 ASLR (Address Space Layout Randomization) (medium)",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Heap-based buffer overflow via surface key truncation in RDPGFX"
},
{
"cve": "CVE-2026-121959",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-11-05T22:22:01.518694+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop (RD) Gateway or network attacker can cause a Denial of Service (DoS) by sending a truncated WebSocket data frame followed by a Transport Layer Security (TLS) connection shutdown. Due to improper handling of the incomplete payload when the connection closes, the client enters an infinite loop, consuming excessive Central Processing Unit (CPU) resources until the application is terminated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via infinite loop on truncated WebSocket frame",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate impact because exploitation requires a client to initiate a connection to a compromised or untrusted Remote Desktop Gateway, limiting the blast radius to client-side denial of service. In typical Red Hat Enterprise Linux environments, FreeRDP is used as an interactive client utility rather than a persistent background service. An untrusted gateway responding with an incomplete transport payload before terminating the secure session causes the client process to loop indefinitely and consume processor capacity, without threatening system data confidentiality or memory integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121959"
},
{
"category": "external",
"summary": "RHBZ#2567740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121959"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121959",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121959"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x26g-fp9v-c2pg",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x26g-fp9v-c2pg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-infinite-loop-via-truncated-websocket-frame",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-infinite-loop-via-truncated-websocket-frame"
}
],
"release_date": "2026-11-04T15:33:23.094000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "To mitigate this restrict FreeRDP connections strictly to trusted RD Gateways and enforce OS-level CPU process resource limits (ulimit / prlimit) to bound CPU exhaustion if a client thread spins. For automated FreeRDP deployments, configure service watchdogs and automatic restarts to recover stalled processes.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via infinite loop on truncated WebSocket frame"
},
{
"cve": "CVE-2026-121960",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-11-05T22:06:59.570096+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567558"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted Credential Security Support Provider (CredSSP) request that omits negotiation tokens. When processing this malformed request with Network Level Authentication (NLA) enabled, the server triggers an internal assertion failure that abruptly terminates the server process and drops active client sessions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via missing negotiation tokens in CredSSP request",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity impact because an unauthenticated remote attacker can trigger an immediate server process termination without credentials or user interaction, resulting in a complete denial of service for active remote sessions. Within Red Hat Enterprise Linux environments, FreeRDP packages are primarily utilized for client-side remote desktop connectivity, and the shadow server utility is neither enabled nor executed by default. The risk is therefore confined to deployments where administrators explicitly run the shadow server with Network Level Authentication enabled and expose its listening port to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121960"
},
{
"category": "external",
"summary": "RHBZ#2567558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567558"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121960"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121960",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121960"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3pg4-5r42-wxvj",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3pg4-5r42-wxvj"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-unauthenticated-denial-of-service-via-credssp-tsrequest",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-unauthenticated-denial-of-service-via-credssp-tsrequest"
}
],
"release_date": "2026-11-04T15:33:23.805000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Restrict network exposure of the FreeRDP shadow server to trusted hosts or terminate the shadow server service if remote desktop sharing is not required.\n\n1. If the shadow server is running and not needed, terminate the `freerdp-shadow-cli` process.\n\n2. If the service must be accessible, restrict incoming connections to authorized management networks using firewalld:\n\nfirewall-cmd --permanent --zone=public --remove-port=3389/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_OR_CIDR\u003e\nfirewall-cmd --reload\n\nCaveat: Restricting network access prevents unauthenticated remote clients from connecting to the shadow server session. Replace the port number if a non-default port was specified.\n\nWarning: Reloading firewall rules with `firewall-cmd --reload` may temporarily disrupt active network traffic.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to isolate the FreeRDP shadow server network boundary by restricting incoming traffic to authorized management hosts or terminating freerdp-shadow-cli: upgrade to FreeRDP 3.32.2+ (or the fixed Freerdp builds), which validates CredSSP TSRequest structures to ensure missing negoTokens do not pass a null buffer to WinPrAsn1Decoder_InitMem and trigger fatal WINPR_ASSERT aborts, closing crafted CredSSP TSRequest containing only the version field and omitting negoTokens. Until patched, this is a concern on deployments running the FreeRDP shadow server with Network Level Authentication enabled and assertions active, so terminate the freerdp-shadow-cli process if desktop sharing is not required, or restrict the listening port via firewall rules strictly to trusted management IP addresses. These controls limit blast radius and contain exploitation, but they do not fix the underlying reachable assertion failure defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via missing negotiation tokens in CredSSP request"
},
{
"cve": "CVE-2026-121961",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-05T21:59:21.726290+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567461"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol (RDP) server can trigger a race condition by repeatedly requesting the creation of an already active dynamic virtual channel while client data is concurrently processed. This issue leads to a use-after-free condition, allowing the server to crash the proxy process and result in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via dynamic channel race condition in proxy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate rather than Important because successful exploitation only results in a denial of service and requires a specific, non-default proxy configuration. Under typical Red Hat enterprise deployments, the freerdp-proxy component is not configured to intercept dynamic virtual channels by default. Furthermore, triggering the condition requires routing an active client session to an untrusted or compromised backend RDP server and winning a multi-threaded timing race to terminate the proxy process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121961"
},
{
"category": "external",
"summary": "RHBZ#2567461",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567461"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121961"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121961",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121961"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race"
}
],
"release_date": "2026-11-04T15:33:24.537000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable dynamic virtual channel interception in freerdp-proxy and restrict target connections to trusted hosts:\n\n1. Operational Configuration: Ensure the proxy configuration does not specify `Intercept=drdynvc` and do not enable proxy modules that intercept dynamic virtual channels. Without dynamic channel interception enabled, the vulnerable tracker path is not invoked.\n2. Network Access Controls: Restrict outbound proxy traffic exclusively to verified, trusted target RDP servers using network egress firewall rules.\n\nCaveats: Disabling dynamic channel interception may prevent inspection or custom processing of dynamic virtual channel features. Modifying proxy configurations requires restarting the freerdp-proxy process, which will terminate active client sessions.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: FreeRDP: Denial of Service via dynamic channel race condition in proxy"
},
{
"cve": "CVE-2026-121962",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-05T22:07:03.137349+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) or memory corruption by sending fragmented responses during Early User Authorization (EUA) authentication. Because FreeRDP fails to properly track remaining buffer space across partial network reads, incoming data advances past the allocated memory boundaries. An attacker who successfully exploits this issue triggers an out-of-bounds memory write, crashing the client application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an attacker-controlled remote desktop server can trigger heap memory corruption or terminate the client process upon connection, presenting a high risk to client integrity and availability rather than a lower-severity transient failure. Successful exploitation requires user interaction to initiate a session to an untrusted or compromised endpoint capable of completing CredSSP negotiation. In Red Hat enterprise environments, FreeRDP primarily functions as an interactive client utility or backend for desktop graphical applications, which limits the blast radius strictly to the invoking user\u0027s local execution environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121962"
},
{
"category": "external",
"summary": "RHBZ#2567559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121962"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j536-qc58-pmf8",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j536-qc58-pmf8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-buffer-overflow-via-early-user-authorization-read",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-buffer-overflow-via-early-user-authorization-read"
}
],
"release_date": "2026-11-04T15:33:25.270000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to ensure FreeRDP validates remaining stream buffer space rather than overall buffer capacity during partial network reads in transport_default_read_pdu: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which track remaining stream buffer capacity instead of overall capacity before advancing the write pointer during partial reads, closing fragmented Early User Authorization responses sent as partial network reads. Until patched, this is a concern on FreeRDP client deployments connecting to remote RDP servers, so Restrict users from initiating RDP connections to untrusted or unverified endpoints capable of negotiating PROTOCOL_HYBRID_EX CredSSP. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap buffer overflow defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization"
},
{
"cve": "CVE-2026-121963",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-05T21:59:34.081848+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the client application. By sending audio data packets over a dynamic virtual channel and immediately closing the connection, the server triggers a use-after-free condition where the client\u0027s audio playback thread accesses already released memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via dynamic audio channel use-after-free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because successful exploitation requires connecting to an untrusted or compromised remote host and results strictly in a client application crash without compromising confidentiality or integrity. In typical enterprise environments, RDP sessions are established with known, managed systems, substantially limiting exposure to rogue servers. Furthermore, the flaw only impacts client sessions handling audio redirection over dynamic channels, and the blast radius is confined to the individual client process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121963"
},
{
"category": "external",
"summary": "RHBZ#2567464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121963"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cx9c-q4jc-wm6c",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cx9c-q4jc-wm6c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dynamic-rdpsnd-channel-close",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dynamic-rdpsnd-channel-close"
}
],
"release_date": "2026-11-04T15:33:25.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via dynamic audio channel use-after-free"
},
{
"cve": "CVE-2026-121964",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-11-05T22:32:18.811773+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2567871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A compromised or malicious Remote Desktop (RD) Gateway server can send specially crafted Remote Procedure Call (RPC) network messages to a connecting client. Because the client verifies total buffer capacity instead of remaining buffer space before writing incoming data, client heap memory can be overwritten. An attacker can exploit this flaw to potentially execute arbitrary code or crash the client application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Arbitrary code execution via RD Gateway RPC client heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because successful exploitation enables a compromised Remote Desktop Gateway to corrupt heap memory and potentially achieve arbitrary code execution with the permissions of the client user. Exploitation requires user initiation by connecting through an untrusted gateway, preventing unauthenticated remote attackers from triggering the vulnerability independently. Furthermore, standard direct RDP connections that do not route traffic through RD Gateway RPC transport are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121964"
},
{
"category": "external",
"summary": "RHBZ#2567871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121964"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121964",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121964"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-buffer-overflow-via-rpc-client-recv-fragment",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-buffer-overflow-via-rpc-client-recv-fragment"
}
],
"release_date": "2026-11-04T15:33:26.687000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:05:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94514"
},
{
"category": "workaround",
"details": "Limit FreeRDP connections strictly to trusted Remote Desktop Gateways and ensure server certificate verification is enforced.\n\nOperational controls:\n1. Avoid routing RDP connections through untrusted or unverified RD Gateways (do not supply untrusted hosts to the `/g:` or `/gw:` parameters).\n2. Connect directly to target RDP servers, utilizing a trusted VPN rather than an intermediate RD Gateway where feasible.\n3. Ensure strict TLS certificate validation is maintained; do not supply the `/cert:ignore` option on the command line or disable certificate validation in connection profiles.\n\nIf FreeRDP client functionality is not required on the system, remove the package:\n# dnf remove freerdp\n\nCaveats: Removing the `freerdp` package may also remove dependent desktop packages or graphical remote desktop clients (such as GNOME Connections or Remmina).\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce remaining stream buffer capacity validation rather than total capacity checks in the FreeRDP RD Gateway RPC client during fragment processing: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which verify remaining buffer capacity from the current stream offset instead of total capacity before writing incoming RPC fragments, closing all 2 injection vectors (crafted RPC BIND_ACK fragments, crafted RPC ALTER_CONTEXT_RESP fragments). Until patched, this is only a concern on FreeRDP client connections routed through an RD Gateway \u2014 Direct RDP connections not routed through RD Gateway RPC transport are unaffected \u2014 so Avoid routing RDP connections through untrusted RD Gateways, connect directly over trusted VPNs instead of intermediate gateways, and maintain strict TLS certificate validation by avoiding cert:ignore options. As a compensating measure, Enable ASLR to randomize FreeRDP memory addresses and complicate reliable exploitation following heap corruption, Enforce Full RELRO and PIE to prevent Global Offset Table overwrites and randomize code segment locations, Use Control Flow Integrity or Shadow Call Stack to validate indirect call targets against function pointer hijacking, Deploy EDR agents to monitor and detect anomalous process execution or memory injection spawned from the FreeRDP process, and Enforce NX/XD non-executable memory protections on the heap to prevent execution of injected payload code. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap-based buffer overflow defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-404 Certificate Pinning (high)",
"product_ids": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.src",
"AppStream-10.2.Z:freerdp-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-2:3.32.2-1.el10_2.x86_64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"AppStream-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-debugsource-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-devel-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-debuginfo-2:3.32.2-1.el10_2.x86_64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.aarch64",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.ppc64le",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.s390x",
"CRB-10.2.Z:libwinpr-devel-2:3.32.2-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Arbitrary code execution via RD Gateway RPC client heap buffer overflow"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.