Vulnerability-Lookup

RHSA-2026:93537

Vulnerability from csaf_redhat - Published: 2026-11-02 05:03 - Updated: 2026-11-02 10:59

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Notes

Topic: An update for freerdp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-91953

A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-91954

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the `gdi_surface_bits` function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 40 products, the same list as for CVE-2026-91953

Threats

Impact Moderate

CVE-2026-91956

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to a client crash and a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 40 products, the same list as for CVE-2026-91953

Threats

Impact Moderate

CVE-2026-91959

A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 40 products, the same list as for CVE-2026-91953

Threats

Impact Moderate

CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 40 products, the same list as for CVE-2026-91953

Threats

Impact Important

CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the `nego_send_negotiation_request` function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled `LoadBalanceInfo` field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 40 products, the same list as for CVE-2026-91953

Threats

Impact Important

References

45 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:93537	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533906	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533911	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533927	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533930	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533951	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533959	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-91953	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533959	external
https://www.cve.org/CVERecord?id=CVE-2026-91953	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91953	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91954	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533906	external
https://www.cve.org/CVERecord?id=CVE-2026-91954	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91954	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533927	external
https://www.cve.org/CVERecord?id=CVE-2026-91956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91956	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91959	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533951	external
https://www.cve.org/CVERecord?id=CVE-2026-91959	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91959	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91963	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533930	external
https://www.cve.org/CVERecord?id=CVE-2026-91963	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91963	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external
https://access.redhat.com/security/cve/CVE-2026-91964	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533911	external
https://www.cve.org/CVERecord?id=CVE-2026-91964	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91964	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for freerdp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)\n\n* FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)\n\n* FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)\n\n* FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)\n\n* FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)\n\n* FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:93537",
        "url": "https://access.redhat.com/errata/RHSA-2026:93537"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2533906",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533906"
      },
      {
        "category": "external",
        "summary": "2533911",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533911"
      },
      {
        "category": "external",
        "summary": "2533927",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533927"
      },
      {
        "category": "external",
        "summary": "2533930",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533930"
      },
      {
        "category": "external",
        "summary": "2533951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533951"
      },
      {
        "category": "external",
        "summary": "2533959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533959"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93537.json"
      }
    ],
    "title": "Red Hat Security Advisory: freerdp security update",
    "tracking": {
      "current_release_date": "2026-11-02T10:59:08+00:00",
      "generator": {
        "date": "2026-11-02T10:59:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:93537",
      "initial_release_date": "2026-11-02T05:03:17+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T05:03:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T05:03:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-02T10:59:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.TUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.13.src",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.13.src",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.13.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.13?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.13?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.13?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.13.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.13.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.13.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.13.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-91953",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input"
      },
      "discovery_date": "2026-09-15T15:38:53.949701+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption.",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91953"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91953"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info"
        }
      ],
      "release_date": "2026-09-15T15:18:09.893000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "To prevent exploitation of this heap buffer overflow, FreeRDP clients should only be used to connect to trusted RDP servers. This operational control reduces the risk of encountering a malicious server redirection PDU.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption."
    },
    {
      "cve": "CVE-2026-91954",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-09-15T15:33:21.355451+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533906"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the `gdi_surface_bits` function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91954"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533906",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533906"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91954"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec"
        }
      ],
      "release_date": "2026-09-15T15:18:10.550000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid connecting to untrusted or unknown RDP servers with FreeRDP clients. This vulnerability requires a FreeRDP client to connect to a malicious RDP server to be exploited.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command"
    },
    {
      "cve": "CVE-2026-91956",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-15T15:37:28.975189+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to a client crash and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91956"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91956"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc"
        }
      ],
      "release_date": "2026-09-15T15:18:11.941000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid connecting to untrusted or unverified RDP servers. Restricting FreeRDP client connections to known, trusted RDP servers can prevent exploitation of this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel"
    },
    {
      "cve": "CVE-2026-91959",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-15T15:39:22.549708+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91959"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91959"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway"
        }
      ],
      "release_date": "2026-09-15T15:18:13.970000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to any FreeRDP instance operating in a server or gateway role, limiting connections to trusted clients or networks. If FreeRDP is used as a client, avoid connecting to untrusted or malicious RDP servers to prevent exploitation.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway"
    },
    {
      "cve": "CVE-2026-91963",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-09-15T15:37:40.378590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533930"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because an attacker controlling a rogue RDP server can extract sensitive pointer information from client heap memory, effectively neutralizing ASLR defenses to facilitate reliable code execution. Exploitation requires user interaction to establish a session with an untrusted host while actively redirecting local USB peripherals. In standard Red Hat Enterprise Linux environments, USB redirection is not enabled by default during client sessions, significantly limiting exposure under typical desktop and workstation usage.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91963"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533930",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533930"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91963",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91963"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91963",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91963"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc",
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc"
        }
      ],
      "release_date": "2026-09-15T15:18:16.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, avoid connecting to untrusted RDP servers or disable the FreeRDP USB redirection channel if it is not required. When using the `xfreerdp` client, ensure that USB redirection is not enabled. This can be done by omitting the `/usb` or `/usb-redir` command-line options, or by explicitly disabling the `urbdrc` channel through FreeRDP configuration if available. Disabling this feature will prevent the redirection of USB devices to the remote session.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure"
    },
    {
      "cve": "CVE-2026-91964",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input"
      },
      "discovery_date": "2026-09-15T15:34:59.900108+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533911"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the `nego_send_negotiation_request` function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled `LoadBalanceInfo` field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity rather than Critical because exploitation requires user interaction, specifically initiating an RDP session to an untrusted or rogue server. In Red Hat Enterprise Linux environments, FreeRDP is typically deployed as a client-side remote desktop utility or shared library supporting graphical connection managers. A rogue endpoint can return malformed redirection data that induces memory corruption during session renegotiation, which may crash the client application or allow arbitrary code execution bounded by the local user\u0027s account privileges.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91964"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533911",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533911"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91964",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91964"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91964",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91964"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken",
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken"
        }
      ],
      "release_date": "2026-09-15T15:18:17.388000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T05:03:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93537"
        },
        {
          "category": "workaround",
          "details": "Users of FreeRDP clients should avoid connecting to untrusted or unknown RDP servers. This operational control reduces the risk of exploitation, as a malicious server is required to trigger the heap-based buffer overflow.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.13.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU"
    }
  ]
}

CVE-2026-91953 (GCVE-0-2026-91953)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-15 16:01

Title

FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

Summary

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:01 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91953",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:01:12.250084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:01:36.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:09.893Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r9pv-ffph-6gg6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info"
        }
      ],
      "title": "FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91953",
    "datePublished": "2026-09-15T15:18:09.893Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-15T16:01:36.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91954 (GCVE-0-2026-91954)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-17 19:28

Title

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

Summary

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 19:15 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

dutchypoo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T19:15:29.879498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T19:28:25.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dutchypoo"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:10.550Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ffjr-p229-hpch)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec"
        }
      ],
      "title": "FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91954",
    "datePublished": "2026-09-15T15:18:10.550Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-17T19:28:25.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91956 (GCVE-0-2026-91956)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-18 17:23

Title

FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

Summary

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 17:15 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

Baixingyuu KeenSecurityLab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:15:30.626368Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:05.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Baixingyuu"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "KeenSecurityLab"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel\u0027s func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:11.941Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hg4r-vv53-vwf8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc"
        }
      ],
      "title": "FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91956",
    "datePublished": "2026-09-15T15:18:11.941Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-18T17:23:05.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91959 (GCVE-0-2026-91959)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-20 00:35

Title

FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

Summary

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-20 00:29 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

Nambers

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91959",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-20T00:29:03.414714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-20T00:35:29.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nambers"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:13.970Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-pj8w-fh79-f438)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway"
        }
      ],
      "title": "FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91959",
    "datePublished": "2026-09-15T15:18:13.970Z",
    "dateReserved": "2026-09-15T11:08:44.669Z",
    "dateUpdated": "2026-09-20T00:35:29.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91963 (GCVE-0-2026-91963)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-15 15:58

Title

FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

Summary

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 15:56 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.0.0 (semver) Affected: 3.0.0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)

Date Public

2026-09-01 00:00

Credits

iarce-qb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91963",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:56:52.431518Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:58:06.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iarce-qb"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:16.675Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hw7p-5h2r-83gq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc"
        }
      ],
      "title": "FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91963",
    "datePublished": "2026-09-15T15:18:16.675Z",
    "dateReserved": "2026-09-15T11:08:44.670Z",
    "dateUpdated": "2026-09-15T15:58:06.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91964 (GCVE-0-2026-91964)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-16 15:51

Title

FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

Summary

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 03:56 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7300 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.0.0 (semver) Affected: 3.0.0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)

Date Public

2026-09-01 00:00

Credits

iarce-qb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T03:56:32.717523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:26.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iarce-qb"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:17.388Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2vf2-grvj-6g8x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken"
        }
      ],
      "title": "FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91964",
    "datePublished": "2026-09-15T15:18:17.388Z",
    "dateReserved": "2026-09-15T11:08:44.670Z",
    "dateUpdated": "2026-09-16T15:51:26.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:93537

CVE-2026-91953 (GCVE-0-2026-91953)

CVE-2026-91954 (GCVE-0-2026-91954)

CVE-2026-91956 (GCVE-0-2026-91956)

CVE-2026-91959 (GCVE-0-2026-91959)

CVE-2026-91963 (GCVE-0-2026-91963)

CVE-2026-91964 (GCVE-0-2026-91964)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour