FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3562-1 advisory.

    - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in `Stream_EnsureCapacity`     (bsc#1258939).
    - CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
    - CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
    - CVE-2026-33982: heap buffer overread in `winpr_aligned_offset_recalloc()` can lead to undefined behavior       (bsc#1261222).
    - CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior     and an 80       billion iteration loop (bsc#1261200).
    - CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data     (bsc#1261211).
    - CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen     (bsc#1261217).
    - CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
    - CVE-2026-33987: heap out-of-bounds write due to persistent cache `bmpSize` desync (bsc#1261226).
    - CVE-2026-33995: double-free in `kerberos_AcceptSecurityContext()` and     `kerberos_InitializeSecurityContextA()` can       lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
    - CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of     service or achieve       remote code execution (bsc#1266317).
    - CVE-2026-40254: off-by-one error in `contains_dotdot()` allows for drive channel path traversal     (bsc#1262743).
    - CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious     client sends       a `CB_CLIP_CAPS` PDU with a too-small `capabilitySetLength` (bsc#1267008).
    - CVE-2026-44421: improper validation in `gdi_CacheToSurface` can lead to a heap buffer overwrite client     when an RDP       server sends crafted RDPGFX PDUs (bsc#1267009).
    - CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's     RDPEAR       authentication-redirection path (bsc#1267010).
    - CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write       (bsc#1267011).
    - CVE-2026-56297: improper synchronization of `channel_callback` access can lead to use-after-free in       `dvcman_channel_close` and `dvcman_call_on_receive` triggered by a malicious RDP server (bsc#1271071).
    - CVE-2026-57156: integer overflow in `update_read_delta_points` allows malicious RDP peers to cause a     heap buffer       overflow (bsc#1271303).
    - CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM `DeviceName` and     `VirtualChannelName`       fields (bsc#1271304).
    - CVE-2026-57158: incomplete fix for CVE-2026-23530 in `planar_decompress_plane_rle_only` allows a     malicious RDP server       to trigger a one byte buffer overflow via a truncated `RDPGFX_CMDID_WIRETOSURFACE_1` planar payload     (bsc#1271305).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP
    clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when
    multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to
    allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in
    version 3.28.0. (CVE-2026-57156)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server
    implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied
    DeviceName and VirtualChannelName fields for a NUL terminator in
    channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound,
    allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in
    version 3.28.0. (CVE-2026-57157)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP
    clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in
    planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a
    truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This
    issue is fixed in version 3.28.0. (CVE-2026-57158)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-931f893f1b advisory.

    Update to 3.28.0

    It fixes CVE-2026-57156, CVE-2026-57157 and CVE-2026-57158.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e2afc3151d advisory.

    Update to 3.28.0

    It fixes CVE-2026-57156, CVE-2026-57157 and CVE-2026-57158.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP     clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when     multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to     allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in     version 3.28.0. (CVE-2026-57156)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
334787	SUSE SLED15: freerdp / freerdp-devel / freerdp-proxy / freerdp-proxy-plugins / etc (SUSE-SU-2026:3562-1)	Nessus	SuSE Local Security Checks	Local	high
444730	Alpine: multiple freerdp packages: security update to 3.29.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
444730	Alpine: multiple freerdp packages: security update to 3.29.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
326976	Fedora 44 : freerdp (2026-931f893f1b)	Nessus	Fedora Local Security Checks	Local	high
326918	Fedora 43 : freerdp (2026-e2afc3151d)	Nessus	Fedora Local Security Checks	Local	high
325534	Linux Distros Unpatched Vulnerability : CVE-2026-57156	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-57156

high

Tenable Plugins

high

high

high

high

high

high