The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20632-1 advisory.

    Changes in freerdp2:

    - Update freerdp-3-macro:
      - Add WINPR_ATTR_MALLOC macro from freerdp 3

    - Security fixes for the following issues:
      * CVE-2026-25941: Fixed a out of bounds read (bsc#1258919)
      * CVE-2026-25942: Fixed a buffer overflow in xf_rail_server_execute_result() (bsc#1258920)
      * CVE-2026-27951: Fixed a denial of service in Stream_EnsureCapacity() (bsc#1258939)
      * CVE-2026-25997: Fixed a use-after-free in xf_clipboard_format_equal() (bsc#1258977)
      * CVE-2026-26986: Fixed a use-after-free in rail_window_free() (bsc#1258967)
      * CVE-2026-27015: Fixed a client denial of service via reachable assert (bsc#1258987)
      * CVE-2026-25952: Fixed a use-after-free in xf_SetWindowMinMaxInfo() (bsc#1258921)
      * CVE-2026-25953: Fixed a use-after-free in xf_AppUpdateWindowFromSurface() (bsc#1258923)
      * CVE-2026-25954: Fixed a use-after-free in xf_rail_server_local_move_size() (bsc#1258924)
      * CVE-2026-24684: Fixed a use-after-free in play_thread() (bsc#1257991).
      * CVE-2026-26271: Fixed a buffer overread in icon processing (bsc#1258979)
      * CVE-2026-26955: Fixed a out of bounds write (bsc#1258982)
      * CVE-2026-26965: Fixed a out of bounds write (bsc#1258985)
      * CVE-2026-31806: Fixed a buffer overflow via improper validation of server messages (bsc#1259653)
      * CVE-2026-31883: Fixed a buffer overflow via crafted audio format and wave data (bsc#1259679)
      * CVE-2026-31885: Fixed a out of bounds read (bsc#1259686)
      * CVE-2026-24491: Fix use-after-free that was accidentally introduced in the backport (bsc#1257981)
      * CVE-2026-22855: Fixed a buffer overflow in smartcard_unpack_set_attrib_call() (bsc#1256721)
      * CVE-2026-22857: Fixed a use-after-free in irp_thread_func() (bsc#1256723)
      * CVE-2026-23533: Fixed a buffer overflow in clear_decompress_residual_data() (bsc#1256943)
      * CVE-2026-23732: Fixed a buffer overflow in Glyph_Alloc() (bsc#1256945)
      * CVE-2026-23883: Fixed a use-after-free (bsc#1256946)
      * CVE-2026-23884: Fixed a use-after-free in gdi_set_bounds (bsc#1256947)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19033 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853)

    * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858)

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

    * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data     (CVE-2026-33984)

    * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages     (CVE-2026-33983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19033 advisory.

    - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
    - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)       Resolves: RHEL-162947, RHEL-162963

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6799 advisory.

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

    * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1433 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between     the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free.
    Specifically, an escaped pointer to sdl->primary (SDL_Surface) is accessed after it has been freed during     RDPGFX ResetGraphics handling. This vulnerability is fixed in 3.20.1. (CVE-2026-22851)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server     can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format     lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and     writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability     is fixed in 3.20.1. (CVE-2026-22852)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow     occurs in drive read when a server-controlled read length is used to read file data into an IRP output     stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This     vulnerability is fixed in 3.20.1. (CVE-2026-22854)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds     read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length.
    This vulnerability is fixed in 3.20.1. (CVE-2026-22855)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial     channel IRP thread tracking allows a heap use-after-free when one thread removes an entry from     serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1. (CVE-2026-22856)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow     was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char     signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized     into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range     restriction and be used as an index into a global lookup table, causing out-of-bounds access. This     vulnerability is fixed in 3.20.1. (CVE-2026-22858)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does     not perform bounds checking on server-supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices     in libusb_udev_complete_msconfig_setup, causing an out-of-bounds read. This vulnerability is fixed in     3.20.1. (CVE-2026-22859)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph     parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`.
    A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS). Version 3.21.0     contains a patch for the issue. (CVE-2026-23732)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-6918 advisory.

    [2:2.11.7-6]
    - Fix use of nsc_process_message       Resolves: RHEL-155984

    [2:2.11.7-5]
    - Backport several CVE fixes       Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980       Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996       Resolves: RHEL-149007, RHEL-149056, RHEL-155984

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10076 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11323 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0266 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-22852:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server     can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format     lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and     writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability     is fixed in 3.20.1.

    CVE-2026-22854:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow     occurs in drive read when a server-controlled read length is used to read file data into an IRP output     stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This     vulnerability is fixed in 3.20.1.

    CVE-2026-22856:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial     channel IRP thread tracking allows a heap useafterfree when one thread removes an entry from     serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.

    CVE-2026-23732:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph     parsing trusts cbData/remaining length and never validates against the minimum size implied by cx/cy. A     malicious server can trigger a clientside global buffer overflow, causing a crash (DoS). Version 3.21.0     contains a patch for the issue.

    CVE-2026-23948:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer     dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP     proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability     is fixed in 3.22.0.

    CVE-2026-24491:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send     client notifications after the control channel is closed, dereferencing a freed callback and triggering a     use after free. This vulnerability is fixed in 3.22.0.

    CVE-2026-24675:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can     free the device's MS config on error but later code still dereferences it, leading to a use after free in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24676:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format     renegotiation frees the active format list while the capture thread continues using audin->format, leading     to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.

    CVE-2026-24679:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses     server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24681:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk     transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after     free in urb_write_completion. This vulnerability is fixed in 3.22.0.

    CVE-2026-24683:
    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches     channel_callback in a local variable and later uses it without synchronization; a concurrent channel close     can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is     fixed in 3.22.0.

    CVE-2026-24684:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async     playback thread can process queued PDUs after the channel is closed and internal state is freed, leading     to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

    CVE-2026-31806:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits()     function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using     NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the     actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that     exceed the expected surface size. Because these values are used during bitmap decoding and memory     operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can     also control the associated pixel data transmitted by the server, the overflow may be exploitable to     overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6340 advisory.

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-11323 advisory.

    - Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732       CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679       CVE-2026-24684 CVE-2026-31806 [Orabug: 39272429]
    - Fixed CVE-2026-26955 CVE-2026-26956 [Orabug: 39189643]
    - Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086]
    - fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533       CVE-2026-23884 [Orabug: 38971897]
    - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
    - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
    - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0752 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-22852:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server     can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format     lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and     writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability     is fixed in 3.20.1.

    CVE-2026-22854:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow     occurs in drive read when a server-controlled read length is used to read file data into an IRP output     stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This     vulnerability is fixed in 3.20.1.

    CVE-2026-22856:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial     channel IRP thread tracking allows a heap useafterfree when one thread removes an entry from     serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.

    CVE-2026-23732:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph     parsing trusts cbData/remaining length and never validates against the minimum size implied by cx/cy. A     malicious server can trigger a clientside global buffer overflow, causing a crash (DoS). Version 3.21.0     contains a patch for the issue.

    CVE-2026-23948:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer     dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP     proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability     is fixed in 3.22.0.

    CVE-2026-24491:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send     client notifications after the control channel is closed, dereferencing a freed callback and triggering a     use after free. This vulnerability is fixed in 3.22.0.

    CVE-2026-24675:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can     free the device's MS config on error but later code still dereferences it, leading to a use after free in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24676:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format     renegotiation frees the active format list while the capture thread continues using audin->format, leading     to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.

    CVE-2026-24679:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses     server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24684:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async     playback thread can process queued PDUs after the channel is closed and internal state is freed, leading     to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

    CVE-2026-31806:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits()     function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using     NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the     actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that     exceed the expected surface size. Because these values are used during bitmap decoding and memory     operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can     also control the associated pixel data transmitted by the server, the overflow may be exploitable to     overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
311767	openSUSE 16 Security Update : freerdp2 (openSUSE-SU-2026:20632-1)	Nessus	SuSE Local Security Checks	2026/5/2	2026/5/2	critical
315441	RHEL 10 : freerdp (RHSA-2026:19033)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/6/12	critical
327011	Oracle Linux 10 : freerdp (ELSA-2026-19033)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	critical
354955	Rocky Linux 10.1 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_6799)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
299562	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1433)	Nessus	Amazon Linux Local Security Checks	2026/2/19	2026/4/30	high
305304	Oracle Linux 8 : freerdp (ELSA-2026-6918)	Nessus	Oracle Linux Local Security Checks	2026/4/8	2026/5/7	critical
309909	RHEL 8 : freerdp (RHSA-2026:10076)	Nessus	Red Hat Local Security Checks	2026/4/23	2026/4/23	critical
310718	RHEL 7 : freerdp (RHSA-2026:11323)	Nessus	Red Hat Local Security Checks	2026/4/28	2026/4/28	critical
310961	TencentOS Server 3: freerdp (TSSA-2026:0266)	Nessus	Tencent Local Security Checks	2026/4/29	2026/4/29	critical
355471	Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_6340)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
320456	Oracle Linux 7 : freerdp (ELSA-2026-11323)	Nessus	Oracle Linux Local Security Checks	2026/6/11	2026/8/15	critical
329215	TencentOS Server 2: freerdp (TSSA-2026:0752)	Nessus	Tencent Local Security Checks	2026/7/23	2026/7/23	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical