FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2142 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP     client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs`     calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The     subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel     process. This vulnerability fixed in 3.28.0. (CVE-2026-63117)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus     in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though     opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates     WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus     write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by     channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit     code execution. This issue is fixed in version 3.28.0. (CVE-2026-63633)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0,     rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a     malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An     authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the     dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation     again at session teardown. This reliably terminates the server and can create allocator-dependent heap     corruption. This issue is fixed in version 3.28.0. (CVE-2026-63652)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0,     planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that     a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes     declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update     whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while     processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed     in version 3.29.0. (CVE-2026-69159)

    A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose     sensitive information from the server or proxy process memory to a downstream client. This occurs because     certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek     instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap     memory that may contain cleartext credentials from previous sessions. (CVE-2026-85089)

    A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the     `general_ChromaV1ToYUV444` function during AVC444 chroma plane reconstruction. A remote attacker, acting     as a malicious Remote Desktop Protocol (RDP) server, can exploit this by sending a specially crafted     `RFX_AVC444_BITMAP_STREAM` with specific frame geometry. This can lead to an out-of-bounds memory read,     potentially disclosing sensitive heap data to the client or causing a client crash, resulting in a denial     of service. (CVE-2026-85090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3906 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0,     rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a     malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An     authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the     dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation     again at session teardown. This reliably terminates the server and can create allocator-dependent heap     corruption. This issue is fixed in version 3.28.0. (CVE-2026-63652)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61378 advisory.

    * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)
      * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders     (CVE-2026-67301)
      * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
      * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
      * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)
      * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)
      * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)
      * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)
      * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)
      * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)
      * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response     (CVE-2026-55194)
      * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode     (CVE-2026-63633)
      * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure     (CVE-2026-69159)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613780 advisory.

    - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652,       CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297,       CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241)       Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534       Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250       Resolves: RHEL-224185

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61378 advisory.

    * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)

    * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)

    * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)

    * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)

    * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)

    * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)

    * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)

    * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)

    * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)

    * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)

    * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response     (CVE-2026-55194)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode     (CVE-2026-63633)

    * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure     (CVE-2026-69159)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61378 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)

    * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)

    * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)

    * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)

    * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)

    * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)

    * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)

    * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)

    * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)

    * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)

    * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response     (CVE-2026-55194)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode     (CVE-2026-63633)

    * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure     (CVE-2026-69159)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0,     rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a     malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An     authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the     dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation     again at session teardown. This reliably terminates the server and can create allocator-dependent heap     corruption. This issue is fixed in version 3.28.0. (CVE-2026-63652)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345797	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2142)	Nessus	Amazon Linux Local Security Checks	Local	high
345762	Amazon Linux 2 : freerdp (ALAS-2026-3906)	Nessus	Amazon Linux Local Security Checks	Local	high
343085	AlmaLinux 10 : freerdp (ALSA-2026:61378)	Nessus	Alma Linux Local Security Checks	Local	high
342750	Oracle Linux 10 : ELSA-2026-61378-0: / freerdp (ELSA-2026-613780)	Nessus	Oracle Linux Local Security Checks	Local	high
342170	RockyLinux 10 : freerdp (RLSA-2026:61378)	Nessus	Rocky Linux Local Security Checks	Local	high
341731	RHEL 10 : freerdp (RHSA-2026:61378)	Nessus	Red Hat Local Security Checks	Local	high
338268	Linux Distros Unpatched Vulnerability : CVE-2026-63652	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63652

high

Tenable Plugins

high

high

high

high

high

high

high