RHSA-2026:98598
Vulnerability from csaf_redhat - Published: 2026-11-11 13:48 - Updated: 2026-11-12 08:27Summary
Red Hat Security Advisory: freerdp security, bug fix, and enhancement update
Severity
Critical
Notes
Topic: An update for freerdp is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)
* FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL (CVE-2026-91948)
* FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
* FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
* FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)
* freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949)
* FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
* FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel (CVE-2026-91951)
* FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
* FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)
* FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
* FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)
* FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)
* FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)
* FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing (CVE-2026-91945)
* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)
* freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676)
* freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838)
* freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830)
* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)
* freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833)
* freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839)
* freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378)
* freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379)
* freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381)
* freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382)
* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)
* freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045)
* freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads (CVE-2026-121386)
* freerdp: freerdp: Denial of Service via zero-width graphics reset (CVE-2026-121402)
* freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages (CVE-2026-121404)
* freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels (CVE-2026-121388)
* freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder (CVE-2026-121394)
Bug Fix(es) and Enhancement(s):
* Rebase FreeRDP to 3.32.2 or newer [rhel-10.3.z] (JIRA:RHEL-277443)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap memory that may contain cleartext credentials from previous sessions.
6.5 (Medium)
Affected products
Fixed
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in FreeRDP. Authenticated RDP clients can exploit an out-of-bounds read vulnerability in smartcard response decoders. This occurs because the decoders fail to validate the length of Answer to Reset (ATR) fields against fixed inline arrays. By sending oversized ATR lengths, an attacker can trigger reads past memory objects, leading to process termination and a denial of service.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server's ResetGraphics Protocol Data Unit (PDU) serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of sensitive data, including live pointers and GLib function addresses, which could defeat Address Space Layout Randomization (ASLR) and reveal the GLib module's base address.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data parsing, leading to memory corruption. This could potentially result in arbitrary code execution or a denial of service.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. An authenticated client can send specially crafted, oversized messages to the server when the CHANNEL_OPTION_SHOW_PROTOCOL feature is active. This can cause a buffer underflow, leading to corruption of memory and potentially allowing an attacker to execute malicious code on the server.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security (RDSTLS) connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can establish RDSTLS connections, thereby circumventing pre-authentication transport restrictions.
9.3 (Critical)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Critical
A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdr_dump_packet function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causing the client to read memory beyond the intended buffer. This can result in client crashes, leading to a denial of service, or the disclosure of sensitive heap memory information in logs. Exploitation requires the client to have WLOG_TRACE-level logging enabled.
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send a specially crafted USB redirection message to the urbdrc client channel. This can trigger an out-of-bounds write, leading to a denial of service (DoS) for the client when verbose asserts are enabled.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the `gdi_surface_bits` function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to a client crash and a denial of service.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the `Stream_EnsureRemainingCapacity` function, leading to an integer wraparound and a double free vulnerability. Successful exploitation results in a denial of service, causing the FreeRDP client to crash during connection.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the `nego_send_negotiation_request` function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled `LoadBalanceInfo` field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to cause memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS) through an application crash.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potentially performing unauthorized actions on the host system.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.
7.1 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer to be allocated, leading to a heap-based buffer overflow during data read operations.
7.3 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.
7.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager (NTLM) authentication path can result in a Denial of Service (DoS). When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check (MIC) offset. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted authentication message, corrupting heap memory and causing the server to crash.
7.4 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.
8.8 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.
7.5 (High)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Important
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.
6.5 (Medium)
Affected products
Fixed
65 products, the same list as for
CVE-2026-85089
Threats
Impact
Moderate
References
241 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for freerdp is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)\n\n* FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL (CVE-2026-91948)\n\n* FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)\n\n* FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)\n\n* FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)\n\n* freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949)\n\n* FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)\n\n* FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel (CVE-2026-91951)\n\n* FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)\n\n* FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)\n\n* FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)\n\n* FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)\n\n* FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)\n\n* FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)\n\n* FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing (CVE-2026-91945)\n\n* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)\n\n* freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676)\n\n* freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838)\n\n* freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830)\n\n* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)\n\n* freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833)\n\n* freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839)\n\n* freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378)\n\n* freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379)\n\n* freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381)\n\n* freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382)\n\n* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)\n\n* freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045)\n\n* freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads (CVE-2026-121386)\n\n* freerdp: freerdp: Denial of Service via zero-width graphics reset (CVE-2026-121402)\n\n* freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages (CVE-2026-121404)\n\n* freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels (CVE-2026-121388)\n\n* freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder (CVE-2026-121394)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase FreeRDP to 3.32.2 or newer [rhel-10.3.z] (JIRA:RHEL-277443)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:98598",
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2527811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527811"
},
{
"category": "external",
"summary": "2533904",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533904"
},
{
"category": "external",
"summary": "2533906",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533906"
},
{
"category": "external",
"summary": "2533911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533911"
},
{
"category": "external",
"summary": "2533913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533913"
},
{
"category": "external",
"summary": "2533925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533925"
},
{
"category": "external",
"summary": "2533927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533927"
},
{
"category": "external",
"summary": "2533928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533928"
},
{
"category": "external",
"summary": "2533930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533930"
},
{
"category": "external",
"summary": "2533942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533942"
},
{
"category": "external",
"summary": "2533951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533951"
},
{
"category": "external",
"summary": "2533954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533954"
},
{
"category": "external",
"summary": "2533957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533957"
},
{
"category": "external",
"summary": "2533959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533959"
},
{
"category": "external",
"summary": "2533965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533965"
},
{
"category": "external",
"summary": "2549790",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549790"
},
{
"category": "external",
"summary": "2550539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550539"
},
{
"category": "external",
"summary": "2552961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552961"
},
{
"category": "external",
"summary": "2552970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552970"
},
{
"category": "external",
"summary": "2552978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552978"
},
{
"category": "external",
"summary": "2552988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552988"
},
{
"category": "external",
"summary": "2552996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552996"
},
{
"category": "external",
"summary": "2553907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553907"
},
{
"category": "external",
"summary": "2553911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553911"
},
{
"category": "external",
"summary": "2553917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553917"
},
{
"category": "external",
"summary": "2553920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553920"
},
{
"category": "external",
"summary": "2554625",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554625"
},
{
"category": "external",
"summary": "2557974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557974"
},
{
"category": "external",
"summary": "2565870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565870"
},
{
"category": "external",
"summary": "2565949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565949"
},
{
"category": "external",
"summary": "2565951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565951"
},
{
"category": "external",
"summary": "2565959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565959"
},
{
"category": "external",
"summary": "2565962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565962"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98598.json"
}
],
"title": "Red Hat Security Advisory: freerdp security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-11-12T08:27:29+00:00",
"generator": {
"date": "2026-11-12T08:27:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:98598",
"initial_release_date": "2026-11-11T13:48:15+00:00",
"revision_history": [
{
"date": "2026-11-11T13:48:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-11T13:48:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-12T08:27:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.3"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-server-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"product_id": "freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_3.aarch64",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_3.aarch64",
"product_id": "libwinpr-2:3.32.2-1.el10_3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_3?arch=aarch64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"product_id": "freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_3.ppc64le",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_3.ppc64le",
"product_id": "libwinpr-2:3.32.2-1.el10_3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_3?arch=ppc64le\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-devel-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-server-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.s390x",
"product_id": "freerdp-libs-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_3.s390x",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_3.s390x",
"product_id": "libwinpr-2:3.32.2-1.el10_3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_3?arch=s390x\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-devel@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-server-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-server-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-devel-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.x86_64",
"product_id": "libwinpr-devel-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-devel@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debugsource@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-debuginfo@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-server-debuginfo@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_id": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr-debuginfo@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"product_id": "freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp-libs@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "libwinpr-2:3.32.2-1.el10_3.x86_64",
"product": {
"name": "libwinpr-2:3.32.2-1.el10_3.x86_64",
"product_id": "libwinpr-2:3.32.2-1.el10_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwinpr@3.32.2-1.el10_3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp-2:3.32.2-1.el10_3.src",
"product": {
"name": "freerdp-2:3.32.2-1.el10_3.src",
"product_id": "freerdp-2:3.32.2-1.el10_3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/freerdp@3.32.2-1.el10_3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src"
},
"product_reference": "freerdp-2:3.32.2-1.el10_3.src",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "libwinpr-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "AppStream-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-devel-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-server-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"relates_to_product_reference": "CRB-10.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr-devel-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
},
"product_reference": "libwinpr-devel-2:3.32.2-1.el10_3.x86_64",
"relates_to_product_reference": "CRB-10.3.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-85089",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-09-03T01:10:56.240368+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2527811"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap memory that may contain cleartext credentials from previous sessions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85089"
},
{
"category": "external",
"summary": "RHBZ#2527811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527811"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85089",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85089"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85089",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85089"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP",
"url": "https://github.com/FreeRDP/FreeRDP"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541",
"url": "https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301",
"url": "https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea",
"url": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0",
"url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory"
}
],
"release_date": "2026-09-03T01:04:43.093000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU"
},
{
"cve": "CVE-2026-91945",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-15T15:39:58.700673+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. Authenticated RDP clients can exploit an out-of-bounds read vulnerability in smartcard response decoders. This occurs because the decoders fail to validate the length of Answer to Reset (ATR) fields against fixed inline arrays. By sending oversized ATR lengths, an attacker can trigger reads past memory objects, leading to process termination and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91945"
},
{
"category": "external",
"summary": "RHBZ#2533965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91945"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91945",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91945"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/commit/9626564421df72c84f891afdbc0b20bf702f369f",
"url": "https://github.com/FreeRDP/FreeRDP/commit/9626564421df72c84f891afdbc0b20bf702f369f"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-smartcard-atr",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-smartcard-atr"
}
],
"release_date": "2026-09-15T15:18:04.458000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable smartcard redirection when connecting to RDP servers using FreeRDP. This can typically be achieved by using the `--disable-smartcard` command-line option for `xfreerdp` or similar configuration in other FreeRDP-based clients. Disabling smartcard redirection may impact functionality that relies on smartcard authentication or access within the RDP session.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing"
},
{
"cve": "CVE-2026-91946",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-09-15T15:34:50.211755+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server\u0027s ResetGraphics Protocol Data Unit (PDU) serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of sensitive data, including live pointers and GLib function addresses, which could defeat Address Space Layout Randomization (ASLR) and reveal the GLib module\u0027s base address.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91946"
},
{
"category": "external",
"summary": "RHBZ#2533913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91946"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91946",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91946"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea",
"url": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-rdpgfx-resetgraphics",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-rdpgfx-resetgraphics"
}
],
"release_date": "2026-09-15T15:18:05.104000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to FreeRDP server instances to only trusted clients and networks. Configure firewall rules to limit inbound connections to the RDP port (typically 3389) from untrusted sources. If FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU"
},
{
"cve": "CVE-2026-91947",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-15T15:38:30.920995+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data parsing, leading to memory corruption. This could potentially result in arbitrary code execution or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated remote attacker could trigger memory corruption leading to service denial or arbitrary code execution, though exploitation requires winning a race condition during session teardown. In Red Hat Enterprise Linux, FreeRDP is primarily utilized as a client-side suite and library, and server-side components are not enabled or running by default in standard installations. Consequently, typical systems are not exposed to this flaw unless an administrator explicitly deploys an RDP server implementation utilizing the affected FreeRDP server libraries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91947"
},
{
"category": "external",
"summary": "RHBZ#2533942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91947"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6mpx-c8rj-whj5",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6mpx-c8rj-whj5"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-server-before-3.31.0-use-after-free-via-drdynvc",
"url": "https://www.vulncheck.com/advisories/freerdp-server-before-3.31.0-use-after-free-via-drdynvc"
}
],
"release_date": "2026-09-15T15:18:05.774000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "The vulnerability requires an authenticated client to interact with the FreeRDP server. To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients and networks. If the FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component to eliminate the attack surface.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption"
},
{
"cve": "CVE-2026-91948",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite"
},
"discovery_date": "2026-09-15T15:32:46.329613+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533904"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An authenticated client can send specially crafted, oversized messages to the server when the CHANNEL_OPTION_SHOW_PROTOCOL feature is active. This can cause a buffer underflow, leading to corruption of memory and potentially allowing an attacker to execute malicious code on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated remote attacker can achieve arbitrary code execution within the server process by transmitting malformed virtual channel data. While exploitation requires low-privilege authentication and specific channel tracking options, the resulting pointer overwrite and potential control-flow hijacking elevate the impact above Moderate. In Red Hat Enterprise Linux environments, FreeRDP is predominantly consumed as a client library, limiting server-side exposure to systems explicitly hosting remote desktop services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91948"
},
{
"category": "external",
"summary": "RHBZ#2533904",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533904"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91948"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91948",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91948"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/commit/40d9202cd95551600c07437ce6bd5ecd7d31e57b",
"url": "https://github.com/FreeRDP/FreeRDP/commit/40d9202cd95551600c07437ce6bd5ecd7d31e57b"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-write-via-show-protocol",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-write-via-show-protocol"
}
],
"release_date": "2026-09-15T15:18:06.465000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients or localhost. This can be achieved by configuring firewall rules to limit inbound connections to the FreeRDP service port. A restart of the FreeRDP server may be required for network configuration changes to take effect.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL"
},
{
"cve": "CVE-2026-91949",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-09-15T15:36:55.070176+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533925"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security (RDSTLS) connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can establish RDSTLS connections, thereby circumventing pre-authentication transport restrictions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "If your RHEL systems only use FreeRDP for outbound client connections, the server-side handshake bypass cannot be exploited against them.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91949"
},
{
"category": "external",
"summary": "RHBZ#2533925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533925"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91949"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91949",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91949"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass"
}
],
"release_date": "2026-09-15T15:18:07.144000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass"
},
{
"cve": "CVE-2026-91950",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-15T15:40:11.181738+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdr_dump_packet function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causing the client to read memory beyond the intended buffer. This can result in client crashes, leading to a denial of service, or the disclosure of sensitive heap memory information in logs. Exploitation requires the client to have WLOG_TRACE-level logging enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because a compromised or malicious remote desktop server can remotely crash the client or disclose process memory without authentication. However, standard Red Hat Enterprise Linux installations run FreeRDP with informational logging levels by default, preventing execution of the vulnerable packet inspection routine unless verbose trace debugging is explicitly activated. Exploitation also requires user interaction to initiate a remote desktop session with device redirection enabled toward an untrusted host.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91950"
},
{
"category": "external",
"summary": "RHBZ#2533954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91950"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-uint32-wraparound",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-uint32-wraparound"
}
],
"release_date": "2026-09-15T15:18:07.841000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid connecting to untrusted or potentially malicious RDP servers. Restricting FreeRDP client connections to only known and trusted RDP servers significantly reduces the attack surface. If connecting to untrusted servers is unavoidable, consider using a highly isolated environment for the client.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure"
},
{
"cve": "CVE-2026-91951",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-15T15:37:34.962234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533928"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send a specially crafted USB redirection message to the urbdrc client channel. This can trigger an out-of-bounds write, leading to a denial of service (DoS) for the client when verbose asserts are enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91951"
},
{
"category": "external",
"summary": "RHBZ#2533928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533928"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91951"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91951",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91951"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h5w2-q35j-443h",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h5w2-q35j-443h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.14.0-through-3.30.0-out-of-bounds-write-via-urbdrc",
"url": "https://www.vulncheck.com/advisories/freerdp-3.14.0-through-3.30.0-out-of-bounds-write-via-urbdrc"
}
],
"release_date": "2026-09-15T15:18:08.518000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the USB redirection (urbdrc) client channel when connecting to untrusted RDP servers. This can typically be achieved by using the `/d:urbdrc` option with `xfreerdp` or similar FreeRDP client commands. Disabling this channel will prevent USB device redirection functionality.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel"
},
{
"cve": "CVE-2026-91953",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-09-15T15:38:53.949701+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533959"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91953"
},
{
"category": "external",
"summary": "RHBZ#2533959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533959"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91953"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91953",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91953"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info"
}
],
"release_date": "2026-09-15T15:18:09.893000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To prevent exploitation of this heap buffer overflow, FreeRDP clients should only be used to connect to trusted RDP servers. This operational control reduces the risk of encountering a malicious server redirection PDU.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption."
},
{
"cve": "CVE-2026-91954",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-09-15T15:33:21.355451+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533906"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the `gdi_surface_bits` function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91954"
},
{
"category": "external",
"summary": "RHBZ#2533906",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533906"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91954"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91954",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91954"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec"
}
],
"release_date": "2026-09-15T15:18:10.550000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid connecting to untrusted or unknown RDP servers with FreeRDP clients. This vulnerability requires a FreeRDP client to connect to a malicious RDP server to be exploited.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command"
},
{
"cve": "CVE-2026-91956",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-15T15:37:28.975189+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to a client crash and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91956"
},
{
"category": "external",
"summary": "RHBZ#2533927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91956"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc"
}
],
"release_date": "2026-09-15T15:18:11.941000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid connecting to untrusted or unverified RDP servers. Restricting FreeRDP client connections to known, trusted RDP servers can prevent exploitation of this vulnerability.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel"
},
{
"cve": "CVE-2026-91959",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-15T15:39:22.549708+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91959"
},
{
"category": "external",
"summary": "RHBZ#2533951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91959"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91959",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91959"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway"
}
],
"release_date": "2026-09-15T15:18:13.970000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to any FreeRDP instance operating in a server or gateway role, limiting connections to trusted clients or networks. If FreeRDP is used as a client, avoid connecting to untrusted or malicious RDP servers to prevent exploitation.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway"
},
{
"cve": "CVE-2026-91960",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-15T15:39:31.098659+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533957"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the `Stream_EnsureRemainingCapacity` function, leading to an integer wraparound and a double free vulnerability. Successful exploitation results in a denial of service, causing the FreeRDP client to crash during connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91960"
},
{
"category": "external",
"summary": "RHBZ#2533957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91960"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91960",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91960"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vccg-35r5-8jrf",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vccg-35r5-8jrf"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-integer-overflow-double-free",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-integer-overflow-double-free"
}
],
"release_date": "2026-09-15T15:18:14.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To mitigate this issue, FreeRDP clients should only connect to trusted and verified Remote Desktop Gateway servers. Connecting to untrusted or unverified servers may expose the client to denial of service attacks.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR"
},
{
"cve": "CVE-2026-91963",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-09-15T15:37:40.378590+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533930"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an attacker controlling a rogue RDP server can extract sensitive pointer information from client heap memory, effectively neutralizing ASLR defenses to facilitate reliable code execution. Exploitation requires user interaction to establish a session with an untrusted host while actively redirecting local USB peripherals. In standard Red Hat Enterprise Linux environments, USB redirection is not enabled by default during client sessions, significantly limiting exposure under typical desktop and workstation usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91963"
},
{
"category": "external",
"summary": "RHBZ#2533930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533930"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91963"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc"
}
],
"release_date": "2026-09-15T15:18:16.675000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid connecting to untrusted RDP servers or disable the FreeRDP USB redirection channel if it is not required. When using the `xfreerdp` client, ensure that USB redirection is not enabled. This can be done by omitting the `/usb` or `/usb-redir` command-line options, or by explicitly disabling the `urbdrc` channel through FreeRDP configuration if available. Disabling this feature will prevent the redirection of USB devices to the remote session.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure"
},
{
"cve": "CVE-2026-91964",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-09-15T15:34:59.900108+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533911"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the `nego_send_negotiation_request` function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled `LoadBalanceInfo` field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity rather than Critical because exploitation requires user interaction, specifically initiating an RDP session to an untrusted or rogue server. In Red Hat Enterprise Linux environments, FreeRDP is typically deployed as a client-side remote desktop utility or shared library supporting graphical connection managers. A rogue endpoint can return malformed redirection data that induces memory corruption during session renegotiation, which may crash the client application or allow arbitrary code execution bounded by the local user\u0027s account privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91964"
},
{
"category": "external",
"summary": "RHBZ#2533911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91964"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91964",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91964"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken"
}
],
"release_date": "2026-09-15T15:18:17.388000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Users of FreeRDP clients should avoid connecting to untrusted or unknown RDP servers. This operational control reduces the risk of exploitation, as a malicious server is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU"
},
{
"cve": "CVE-2026-109242",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-10-12T16:50:24.134372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2549790"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Moderate because a compromised or malicious remote desktop endpoint can trigger an unhandled crash or leak uninitialized process memory to the client display without requiring privileges. In Red Hat Enterprise Linux, FreeRDP packages are primarily utilized to establish outbound remote desktop sessions, meaning exposure depends on connecting to an untrusted server. While the attack occurs over the network, exploitation relies on user interaction to initiate the connection to a rogue host rather than exposing a continuously listening network service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109242"
},
{
"category": "external",
"summary": "RHBZ#2549790",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549790"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109242"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109242",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109242"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade"
}
],
"release_date": "2026-10-12T16:04:18.336000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling"
},
{
"cve": "CVE-2026-109676",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-13T13:58:50.614349+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to cause memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS) through an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because a malicious RDP peer can trigger memory corruption in the FreeRDP client after the user connects (UI:R), with potential impact beyond a simple crash. Red Hat heap/allocator hardening and ASLR raise exploitation difficulty but do not justify lowering Confidentiality/Integrity/Availability in the base score when corruption is confirmed. This is the highest-severity issue in this FreeRDP set (CVSS 8.8) but remains Important rather than Critical because exploitation requires the user to connect to a malicious RDP server (UI:R).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109676"
},
{
"category": "external",
"summary": "RHBZ#2550539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109676"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect"
}
],
"release_date": "2026-10-13T13:27:05.624000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect"
},
{
"cve": "CVE-2026-110830",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-10-14T23:01:57.961596+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat Enterprise Linux because the impact is confined to client-side denial of service and requires an explicit, non-default feature configuration. FreeRDP does not enable serial device redirection by default, meaning an attacker-controlled RDP server can only trigger descriptor exhaustion if the client session specifically opted into serial forwarding. Additionally, the flaw affects only availability without impacting system confidentiality or data integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110830"
},
{
"category": "external",
"summary": "RHBZ#2552970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110830"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-denial-of-service-via-serial-irp-mj-create",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-denial-of-service-via-serial-irp-mj-create"
}
],
"release_date": "2026-10-14T22:52:05.434000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling"
},
{
"cve": "CVE-2026-110833",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-10-14T23:03:24.773509+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552988"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an established session with device redirection and a proxy explicitly configured to intercept RDPDR channel traffic, resulting in resource exhaustion without compromising data integrity, confidentiality, or allowing arbitrary code execution. In standard Red Hat deployments, FreeRDP is predominantly utilized as a client application or library rather than an intermediary proxy service. Consequently, typical environments are not exposed to this issue unless the proxy is actively deployed with channel interception enabled. Furthermore, Red Hat Enterprise Linux 8 and 9 are unaffected because they provide earlier FreeRDP versions lacking the vulnerable proxy code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110833"
},
{
"category": "external",
"summary": "RHBZ#2552988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110833"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-unbounded-memory-retention-via-rdpdr-proxy",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-unbounded-memory-retention-via-rdpdr-proxy"
}
],
"release_date": "2026-10-14T22:52:08.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly"
},
{
"cve": "CVE-2026-110837",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-10-14T23:02:39.532885+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552978"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because crafted MP3 audio from a malicious RDP server can cause a heap buffer overflow in the client after the user connects (UI:R), with integrity and availability impact and limited confidentiality impact (CVSS 7.1). Decode-path constraints keep Attack Complexity High. Allocator hardening may impede exploitation but does not clear I:H/A:H.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110837"
},
{
"category": "external",
"summary": "RHBZ#2552978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552978"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110837"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110837",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110837"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding"
}
],
"release_date": "2026-10-14T22:52:12.464000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding"
},
{
"cve": "CVE-2026-110838",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Functionality"
},
"discovery_date": "2026-10-14T23:01:12.986657+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user\u0027s active session, potentially performing unauthorized actions on the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as Important because an unauthenticated remote attacker with network access to a running shadow server can bypass authentication checks and inject synthetic keystrokes directly into an active graphical session. This issue specifically affects environments using FreeRDP 3, which is included in Red Hat Enterprise Linux 10, whereas earlier enterprise versions utilizing FreeRDP 2 do not contain the vulnerable state-machine code. Overall exposure is limited on standard systems because the FreeRDP shadow daemon is not active by default and requires explicit execution by an administrator or user.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110838"
},
{
"category": "external",
"summary": "RHBZ#2552961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110838"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110838",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110838"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass",
"url": "https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass"
}
],
"release_date": "2026-10-14T22:52:13.434000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Do not expose freerdp-shadow-cli to untrusted networks. Restrict access with host firewalling and require authentication.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch"
},
{
"cve": "CVE-2026-110839",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-14T23:04:05.291392+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because a malicious RDP endpoint can trigger a heap out-of-bounds write during JPEG clipboard conversion after the user connects (UI:R), impacting integrity and availability (CVSS 7.1). Platform hardening may impede reliable exploitation but does not remove I:L/A:H from the base score.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-110839"
},
{
"category": "external",
"summary": "RHBZ#2552996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-110839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110839"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data",
"url": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data"
}
],
"release_date": "2026-10-14T22:52:14.540000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "If clipboard redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion"
},
{
"cve": "CVE-2026-111378",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-16T01:40:56.515294+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553907"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having an Important impact because an unauthenticated remote attacker can exhaust server memory prior to authentication without requiring valid user credentials or privileges. While FreeRDP packages in Red Hat Enterprise Linux are primarily utilized for client-side connectivity, server implementations and services utilizing FreeRDP server libraries with Network Level Authentication are exposed to denial of service from unbounded buffer growth. Deployments that solely execute FreeRDP as an outbound client remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111378"
},
{
"category": "external",
"summary": "RHBZ#2553907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553907"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111378"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111378",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111378"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser"
}
],
"release_date": "2026-10-16T01:17:46.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required.\n\n1. Restrict RDP access to trusted network sources using firewalld:\n# firewall-cmd --permanent --zone=public --remove-service=rdp\n# firewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_IP_or_CIDR\u003e\n# firewall-cmd --reload\n\n2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop):\n# systemctl --user --now mask gnome-remote-desktop.service\n\nCaveats and Warnings:\nReloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser"
},
{
"cve": "CVE-2026-111379",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:10.685620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553911"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer to be allocated, leading to a heap-based buffer overflow during data read operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An important-severity heap-based buffer overflow was found in FreeRDP\u0027s persistent bitmap cache handling. When FreeRDP loads a persistent cache file, an integer wraparound in the size calculation in persist_cache_get_data, triggered by large attacker-controlled width and height values in a crafted v3 persistent cache file, causes an undersized buffer to be allocated, which is then overflowed when the entry is read in persistent_cache_read_entry_v3. A local attacker who can place a crafted persistent cache file and have it loaded by a user could use this flaw to crash the FreeRDP client or potentially execute arbitrary code in the context of the client process. The freerdp component is affected as shipped in multiple Red Hat Enterprise Linux versions, in Red Hat In-Vehicle OS, and in the Fedora and EPEL community streams, where a fix is being pursued; the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 score of 7.3, consistent with the upstream severity assessment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111379"
},
{
"category": "external",
"summary": "RHBZ#2553911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111379"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3"
}
],
"release_date": "2026-10-16T01:17:47.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file"
},
{
"cve": "CVE-2026-111381",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:32.679134+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553917"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Arbitrary code execution via crafted persistent cache file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow was found in FreeRDP\u0027s persistent cache v2 parser (persistent_cache_read_entry_v2 in libfreerdp/cache/persistent.c). An integer wraparound in the bitmap size calculation allows a crafted persistent cache v2 file containing oversized width and height values to bypass bounds checks, causing mismatched entry size accounting and fixed 16 KiB reads that corrupt heap memory. A local attacker can exploit this flaw by convincing a user to load a maliciously crafted persistent cache file, resulting in a crash of the FreeRDP client or potential arbitrary code execution in the context of the user running the client. Red Hat rates this flaw as IMPORTANT (CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream Important rating, with exploitation requiring user interaction to load the attacker-supplied cache file. The freerdp package as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10, freerdp and freerdp2 in Red Hat In-Vehicle OS, and freerdp and freerdp2 in Fedora and EPEL are affected, and fixes for these products are being pursued.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111381"
},
{
"category": "external",
"summary": "RHBZ#2553917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111381"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111381",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111381"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser"
}
],
"release_date": "2026-10-16T01:17:50.516000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Arbitrary code execution via crafted persistent cache file"
},
{
"cve": "CVE-2026-111382",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-16T01:41:50.190968+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553920"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Arbitrary code execution via crafted display frames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because successful exploitation could allow a remote server to execute arbitrary code within the privileges of the connecting client user, rather than affecting the underlying system with elevated privileges. Within Red Hat Enterprise Linux, FreeRDP functions as a client application and library for Remote Desktop Protocol sessions. The flaw is not directly exploitable over the network unless a local user or automated service actively initiates a connection to an untrusted or malicious endpoint. Environments that do not establish outbound RDP connections are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111382"
},
{
"category": "external",
"summary": "RHBZ#2553920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111382"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-out-of-bounds-write-in-avc444-yuv444-combine",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-out-of-bounds-write-in-avc444-yuv444-combine"
}
],
"release_date": "2026-10-16T01:17:51.334000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Arbitrary code execution via crafted display frames"
},
{
"cve": "CVE-2026-111880",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-17T19:02:09.270418+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2554625"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager (NTLM) authentication path can result in a Denial of Service (DoS). When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check (MIC) offset. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted authentication message, corrupting heap memory and causing the server to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is reachable only on FreeRDP server or proxy peers that configure the non-default SspiNtlmHashCallback NTLM hash callback, which is reflected as Attack Complexity: High. An unauthenticated network attacker can cause a fixed 16-byte out-of-bounds heap write, so Integrity and Availability are High; Confidentiality is None. Red Hat rates this Important. Platform safeguards such as ASLR, NX, FORTIFY_SOURCE, and glibc allocator hardening may impede reliable code execution, but they do not prevent the out-of-bounds write or process crash, so the base metrics are unchanged.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111880"
},
{
"category": "external",
"summary": "RHBZ#2554625",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554625"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111880"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111880",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111880"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset",
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset"
}
],
"release_date": "2026-10-17T18:46:08.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Do not expose FreeRDP server or proxy endpoints that use SspiNtlmHashCallback to untrusted networks; restrict access with a host firewall and network segmentation. If the NTLM hash callback is not required, leave it unset so the vulnerable MIC path is not entered.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds validation on Message Integrity Check (MIC) offsets within the authenticate message buffer before writing in ntlm_computeMicValue: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which validate that the MIC offset is within the authenticate message buffer bounds before writing bytes, closing crafted NTLM AUTHENTICATE_MESSAGE with backward session-key offset and out-of-bounds MIC offset. Until patched, this is a concern on FreeRDP server and proxy instances configured with the non-default SspiNtlmHashCallback setting, so leave SspiNtlmHashCallback unset if NTLM hash callbacks are not required, and restrict network access to FreeRDP endpoints from untrusted networks using firewalls and network segmentation. As a compensating measure, configure systemd service restart and watchdog settings to automatically restart FreeRDP upon process crashes and mitigate prolonged denial of service, require pre-authentication through a zero-trust gateway or identity-aware proxy before clients can reach the FreeRDP NTLM authentication handler, and restrict FreeRDP port access with host firewalls using firewalld or nftables to isolate the service from untrusted networks. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds write defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication"
},
{
"cve": "CVE-2026-114045",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-10-21T00:55:40.781083+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557974"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important because an authenticated RDP client can trigger a heap-based buffer overflow in the FreeRDP server audio (rdpsnd) channel without further user interaction (PR:L, UI:N), with High impact on confidentiality, integrity, and availability. The vulnerable code is in the server-side rdpsnd path shipped when FreeRDP server components (for example freerdp-server / freerdp-shadow-cli) are built and used. Red Hat products that ship FreeRDP with server support before 3.32.1 are affected. Platform hardening such as ASLR, NX, and FORTIFY_SOURCE may make reliable exploitation more difficult but does not remove the underlying memory-corruption risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114045"
},
{
"category": "external",
"summary": "RHBZ#2557974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557974"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114045"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114045",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114045"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format"
}
],
"release_date": "2026-10-21T00:36:24.094000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "If FreeRDP server or shadow components are unused, remove or disable them.\nRestrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats"
},
{
"cve": "CVE-2026-121386",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-11-03T15:12:43.602610+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact for Red Hat products because an untrusted remote desktop host or network intermediary can terminate the client session unexpectedly without prior authentication. Although this defect causes application termination rather than remote code execution, it directly impacts the availability of user sessions in enterprise environments. Exploitation requires an established connection to a malicious RDP endpoint or interception by an adversary on the network path processing shared clipboard content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121386"
},
{
"category": "external",
"summary": "RHBZ#2565870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121386"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers"
}
],
"release_date": "2026-11-03T14:27:53.842000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
},
{
"category": "workaround",
"details": "Disable clipboard redirection for RDP connections.\n\nWhen launching sessions with the xfreerdp command-line utility, explicitly disable the clipboard channel:\n```\nxfreerdp -clipboard /v:\u003cserver_address\u003e\n```\n\nWhen connecting via graphical clients, disable clipboard synchronization within the respective connection profile preferences.\n\nCaveats:\nDisabling clipboard redirection prevents transferring text, images, or files between the local system and the remote session.\n\nWarning:\nChanges apply to new connections; any active RDP sessions must be disconnected and restarted for the setting to take effect.\n\n--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to disable clipboard redirection in FreeRDP client connections to prevent processing untrusted image buffers through WinPR: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which install setjmp error handlers for libpng and libjpeg in winpr_read_png_from_buffer, winpr_convert_from_jpeg, and winpr_convert_to_jpeg, closing all 2 injection vectors (malformed PNG clipboard payload, truncated JPEG clipboard payload). Until patched, this is a concern on FreeRDP client sessions with clipboard redirection enabled connecting across untrusted networks or to untrusted RDP servers, so Disable clipboard redirection by using the -clipboard flag in xfreerdp or disabling clipboard synchronization in graphical connection profiles, then disconnect and restart active sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing image library error-handling defect \u2014 apply the upstream patch to fully remediate.",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads"
},
{
"cve": "CVE-2026-121388",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-11-03T16:55:30.875628+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565959"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can exhaust client memory by sending DRDYNVC DATA_FIRST messages with an oversized length field, resulting in a denial of service. The user must connect to an attacker-controlled server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121388"
},
{
"category": "external",
"summary": "RHBZ#2565959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565959"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121388"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first"
}
],
"release_date": "2026-11-03T14:27:55.216000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels"
},
{
"cve": "CVE-2026-121394",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-11-03T16:58:36.652636+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted packet triggering an assertion failure in the RemoteFX decoder, resulting in a denial of service. The user must connect to an attacker-controlled server and RemoteFX must be enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121394"
},
{
"category": "external",
"summary": "RHBZ#2565962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121394"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121394",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121394"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder"
}
],
"release_date": "2026-11-03T14:27:59.158000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder"
},
{
"cve": "CVE-2026-121402",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-11-03T16:45:41.194137+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via zero-width graphics reset",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted zero-width graphics reset that triggers a NULL pointer dereference, resulting in a denial of service. The user must connect to an attacker-controlled server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121402"
},
{
"category": "external",
"summary": "RHBZ#2565949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121402"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121402",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121402"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics"
}
],
"release_date": "2026-11-03T14:28:04.673000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via zero-width graphics reset"
},
{
"cve": "CVE-2026-121404",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-11-03T16:46:02.560516+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2565951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in FreeRDP. An attacker controlling an RDP server can cause a connected FreeRDP client to spin indefinitely by sending zero-length dynamic virtual channel messages, resulting in a denial of service. An authenticated RDP session is required.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-121404"
},
{
"category": "external",
"summary": "RHBZ#2565951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-121404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121404"
},
{
"category": "external",
"summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data"
}
],
"release_date": "2026-11-03T14:28:06.089000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T13:48:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98598"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src",
"AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x",
"CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.