FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0031 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-23530:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version     3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against     `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a clientside heap     buffer overflow, causing a crash (DoS) and potential heap corruption with codeexecution risk depending     on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23531:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec,     when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating     the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A     malicious server can trigger a clientside heap buffer overflow, causing a crash (DoS) and potential     heap corruption with codeexecution risk depending on allocator behavior and surrounding heap layout.
    Version 3.21.0 contains a patch for the issue.

    CVE-2026-23532:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the  FreeRDP clients `gdi_SurfaceToSurface` path due to a mismatch     between destination rectangle clamping and the actual copy size. A malicious server can trigger a     clientside heap buffer overflow, causing a crash (DoS) and potential heap corruption with     codeexecution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains     a patch for the issue.

    CVE-2026-23533:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data     causes out-of-bounds writes during color output. A malicious server can trigger a clientside heap     buffer overflow, causing a crash (DoS) and potential heap corruption with codeexecution risk depending     on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23534:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes     past the end of the destination surface buffer. A malicious server can trigger a clientside heap buffer     overflow, causing a crash (DoS) and potential heap corruption with codeexecution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New`     frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again,     triggering ASan UAF. A malicious server can trigger a clientside use after free, causing a crash (DoS)     and potential heap corruption with codeexecution risk depending on allocator behavior and surrounding     heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23884:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap     deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A     malicious server can trigger a clientside use after free, causing a crash (DoS) and potential heap     corruption with codeexecution risk depending on allocator behavior and surrounding heap layout. Version     3.21.0 contains a patch for the issue.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-161:03 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)
      * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
      * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)
      * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service     and potential code execution. (CVE-2026-23531)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)
      * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2222 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2048 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)
      * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
      * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)
      * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service     and potential code execution. (CVE-2026-23531)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)
      * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2222 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)
      * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
      * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)
      * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service     and potential code execution. (CVE-2026-23531)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)
      * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2222 advisory.

    [2:3.10.3-5.1]
    - Backport several CVE fixes       Resolves: RHEL-142413, RHEL-142397, RHEL-142381, RHEL-142365, RHEL-142349       Resolves: RHEL-142333, RHEL-142317

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-152:02 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)
      * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
      * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)
      * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service     and potential code execution. (CVE-2026-23531)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)
      * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2222 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2048 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2081 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2081 advisory.

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)
      * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
      * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)
      * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service     and potential code execution. (CVE-2026-23531)
      * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)
      * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2081 advisory.

    [2:2.11.7-2]
    - Backport several CVE fixes       Resolves: RHEL-142417, RHEL-142401, RHEL-142385, RHEL-142369, RHEL-142353       Resolves: RHEL-142337, RHEL-142321

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1379 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version     3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against     `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client-side heap buffer     overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
    (CVE-2026-23530)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec,     when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating     the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A     malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap     corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version     3.21.0 contains a patch for the issue. (CVE-2026-23531)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the  FreeRDP client's `gdi_SurfaceToSurface` path due to a mismatch between     destination rectangle clamping and the actual copy size. A malicious server can trigger a client-side heap     buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
    (CVE-2026-23532)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data     causes out-of-bounds writes during color output. A malicious server can trigger a client-side heap buffer     overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
    (CVE-2026-23533)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes     past the end of the destination surface buffer. A malicious server can trigger a client-side heap buffer     overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
    (CVE-2026-23534)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New`     frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again,     triggering ASan UAF. A malicious server can trigger a client-side use after free, causing a crash (DoS)     and potential heap corruption with code-execution risk depending on allocator behavior and surrounding     heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23883)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap     deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A     malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap     corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version     3.21.0 contains a patch for the issue. (CVE-2026-23884)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2048 advisory.

    [2:2.11.7-1.1]
    - Backport several CVE fixes       Resolves: RHEL-142426, RHEL-142410, RHEL-142394, RHEL-142378, RHEL-142362,       Resolves: RHEL-142346, RHEL-142330

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2048 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2081 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a     malicious server. (CVE-2026-23530)

    * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability     (CVE-2026-23884)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

    * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution     (CVE-2026-23533)

    * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and     potential code execution. (CVE-2026-23531)

    * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow     (CVE-2026-23534)

    * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow     (CVE-2026-23532)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0345-1 advisory.

    - CVE-2025-4478: Fixed initialization of function pointers after       resource allocations (bsc#1243109)
    - CVE-2026-22851: Fixed RDPGFX ResetGraphics race leading to       use-after-free in SDL client (sdl->primary) (bsc#1256717)
    - CVE-2026-22852: Fixed heap-buffer-overflow in audin_process_formats       (bsc#1256718)
    - CVE-2026-22853: Fixed heap-buffer-overflow in ndr_read_uint8Array       (bsc#1256719)
    - CVE-2026-22854: Fixed heap-buffer-overflow in drive_process_irp_read       (bsc#1256720)
    - CVE-2026-22855: Fixed heap-buffer-overflow in smartcard_unpack_set_attrib_call       (bsc#1256721)
    - CVE-2026-22856: Fixed heap-use-after-free in create_irp_thread (bsc#1256722)
    - CVE-2026-22857: Fixed heap-use-after-free in irp_thread_func (bsc#1256723)
    - CVE-2026-22858: Fixed global-buffer-overflow in crypto_base64_devoce       (bsc#1256724)
    - CVE-2026-22859: Fixed heap-buffer-overflow in urb_select_configuration       (bsc#1256725)
    - CVE-2026-23530: Fixed improper validation leading to heap buffer overflow       in `planar_decompress_plane_rle` (bsc#1256940)
    - CVE-2026-23531: Fixed improper validation in `clear_decompress` leading to       heap buffer overflow (bsc#1256941)
    - CVE-2026-23532: Fixed mismatch between destination rectangle clamping and       the actual copy size leading to heap buffer overflow in       `gdi_SurfaceToSurface` (bsc#1256942)
    - CVE-2026-23533: Fixed improper validation leading to heap buffer overflow in       `clear_decompress_residual_data` (bsc#1256943)
    - CVE-2026-23534: Fixed missing checks leading to heap buffer overflow in       `clear_deceompress_bands_data` (bsc#1256944)
    - CVE-2026-23732: Fixed improper validation leading to heap buffer overflow in       `Glyph_alloc` (bsc#1256945)
    - CVE-2026-23883: Fixed use-after-free when `update_pointer_color` and       `freerdp_image_copy_fromPointer_data` fail (bsc#1256946)
    - CVE-2026-23884: Fixed use-after-free in `gdi_set_bounds` (bsc#1256947)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0039 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-23883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New`     frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again,     triggering ASan UAF. A malicious server can trigger a clientside use after free, causing a crash (DoS)     and potential heap corruption with codeexecution risk depending on allocator behavior and surrounding     heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23534:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes     past the end of the destination surface buffer. A malicious server can trigger a clientside heap buffer     overflow, causing a crash (DoS) and potential heap corruption with codeexecution risk depending on     allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

    CVE-2026-23532:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side     heap buffer overflow occurs in the  FreeRDP clients `gdi_SurfaceToSurface` path due to a mismatch     between destination rectangle clamping and the actual copy size. A malicious server can trigger a     clientside heap buffer overflow, causing a crash (DoS) and potential heap corruption with     codeexecution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains     a patch for the issue.

    CVE-2026-23531:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec,     when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating     the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A     malicious server can trigger a clientside heap buffer overflow, causing a crash (DoS) and potential     heap corruption with codeexecution risk depending on allocator behavior and surrounding heap layout.
    Version 3.21.0 contains a patch for the issue.

    CVE-2026-23530:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version     3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against     `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a clientside heap     buffer overflow, causing a crash (DoS) and potential heap corruption with codeexecution risk depending     on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-943caf40d9 advisory.

    Update to 3.21.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-23d669bf94 advisory.

    Update to 3.21.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New`     frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again,     triggering ASan UAF. A malicious server can trigger a clientside use after free, causing a crash (DoS)     and potential heap corruption with codeexecution risk depending on allocator behavior and surrounding     heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23883)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298940	Alibaba Cloud Linux 3 : 0031: freerdp (ALINUX3-SA-2026:0031)	Nessus	Alibaba Cloud Linux Local Security Checks	high
298755	MiracleLinux 9 : freerdp-2.11.7-1.el9_7.1 (AXSA:2026-161:03)	Nessus	Miracle Linux Local Security Checks	high
298622	RockyLinux 10 : freerdp (RLSA-2026:2222)	Nessus	Rocky Linux Local Security Checks	high
298478	AlmaLinux 9 : freerdp (ALSA-2026:2048)	Nessus	Alma Linux Local Security Checks	high
298477	AlmaLinux 10 : freerdp (ALSA-2026:2222)	Nessus	Alma Linux Local Security Checks	high
298408	Oracle Linux 10 : freerdp (ELSA-2026-2222)	Nessus	Oracle Linux Local Security Checks	high
298347	MiracleLinux 8 : freerdp-2.11.7-2.el8_10 (AXSA:2026-152:02)	Nessus	Miracle Linux Local Security Checks	high
298334	RHEL 10 : freerdp (RHSA-2026:2222)	Nessus	Red Hat Local Security Checks	high
298300	RockyLinux 9 : freerdp (RLSA-2026:2048)	Nessus	Rocky Linux Local Security Checks	high
298204	RockyLinux 8 : freerdp (RLSA-2026:2081)	Nessus	Rocky Linux Local Security Checks	high
298191	AlmaLinux 8 : freerdp (ALSA-2026:2081)	Nessus	Alma Linux Local Security Checks	high
298170	Oracle Linux 8 : freerdp (ELSA-2026-2081)	Nessus	Oracle Linux Local Security Checks	high
298143	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1379)	Nessus	Amazon Linux Local Security Checks	high
298066	Oracle Linux 9 : freerdp (ELSA-2026-2048)	Nessus	Oracle Linux Local Security Checks	high
298052	RHEL 9 : freerdp (RHSA-2026:2048)	Nessus	Red Hat Local Security Checks	high
298012	RHEL 8 : freerdp (RHSA-2026:2081)	Nessus	Red Hat Local Security Checks	high
297418	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2026:0345-1)	Nessus	SuSE Local Security Checks	high
297109	TencentOS Server 4: freerdp (TSSA-2026:0039)	Nessus	Tencent Local Security Checks	high
296987	Fedora 42 : freerdp (2026-943caf40d9)	Nessus	Fedora Local Security Checks	high
296240	Fedora 43 : freerdp (2026-23d669bf94)	Nessus	Fedora Local Security Checks	high
291614	Linux Distros Unpatched Vulnerability : CVE-2026-23883	Nessus	Misc.	high

Detections

Analytics

CVE-2026-23883

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high