FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.

ciq crlsa-2026_75570: CRLSA-2026_75570: Important: freerdp security update

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76747 advisory.

    [2:2.11.7-14]
    - Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956,       CVE-2026-91959, CVE-2026-91963, CVE-2026-91964)       Resolves: RHEL-260751, RHEL-260776, RHEL-260800, RHEL-260846, RHEL-260860       Resolves: RHEL-260892

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76747 advisory.

    * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)

    * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU     (CVE-2026-91964)

    * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)

    * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)

    * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)

    * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap     corruption. (CVE-2026-91953)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76747 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)

    * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU     (CVE-2026-91964)

    * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)

    * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)

    * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)

    * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap     corruption. (CVE-2026-91953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75570 advisory.

    [2:3.10.3-12.14]
    - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947,       CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956,       CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964)       Resolves: RHEL-253892, RHEL-260716, RHEL-260750, RHEL-260763, RHEL-260778       Resolves: RHEL-260794, RHEL-260807, RHEL-260842, RHEL-260856, RHEL-260891       Resolves: RHEL-260912

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75570 advisory.

    * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session     Info PDU (CVE-2026-85089)

    * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)

    * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU     (CVE-2026-91964)

    * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)

    * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)

    * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)

    * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption     (CVE-2026-91947)

    * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)

    * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure     (CVE-2026-91950)

    * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)

    * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap     corruption. (CVE-2026-91953)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75570 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session     Info PDU (CVE-2026-85089)

    * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)

    * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU     (CVE-2026-91964)

    * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)

    * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)

    * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)

    * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption     (CVE-2026-91947)

    * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)

    * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure     (CVE-2026-91950)

    * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)

    * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap     corruption. (CVE-2026-91953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3938 advisory.

    A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose     sensitive information from the server or proxy process memory to a downstream client. This occurs because     certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek     instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap     memory that may contain cleartext credentials from previous sessions. (CVE-2026-85089)

    A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the     `general_ChromaV1ToYUV444` function during AVC444 chroma plane reconstruction. A remote attacker, acting     as a malicious Remote Desktop Protocol (RDP) server, can exploit this by sending a specially crafted     `RFX_AVC444_BITMAP_STREAM` with specific frame geometry. This can lead to an out-of-bounds memory read,     potentially disclosing sensitive heap data to the client or causing a client crash, resulting in a denial     of service. (CVE-2026-85090)

    FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's     ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format.
    Attackers can receive uninitialized heap memory including live pointers and GLib function addresses     transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address. (CVE-2026-91946)

    FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that     dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race     AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing     freed channel objects. (CVE-2026-91947)

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in     nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before     writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server     Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-     controlled content, causing denial of service or heap corruption before authentication completes.
    (CVE-2026-91953)

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's     func_get_ep_desc function that indexes interface arrays by position instead of protocol field     InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted     InterfaceNumber values to read past allocated heap memory and crash the client. (CVE-2026-91956)

    FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when     worker thread creation fails after device registration. Attackers can trigger thread creation failure     during channel setup to cause device pointer deallocation while devman retains a reference, leading to     crash or code execution. (CVE-2026-91957)

    FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files,     allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an     out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in     xfreerdp. (CVE-2026-91958)

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the     RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to     trigger an out-of-bounds read causing process abort. (CVE-2026-91959)

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc     USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized     heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory     corruption vulnerabilities. (CVE-2026-91963)

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when     processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious     RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed     512-byte buffer without validation, causing client crashes or potential code execution when chained with     memory disclosure. (CVE-2026-91964)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the     RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to     trigger an out-of-bounds read causing process abort. (CVE-2026-91959)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2142 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP     client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs`     calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The     subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel     process. This vulnerability fixed in 3.28.0. (CVE-2026-63117)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus     in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though     opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates     WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus     write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by     channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit     code execution. This issue is fixed in version 3.28.0. (CVE-2026-63633)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0,     rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a     malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An     authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the     dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation     again at session teardown. This reliably terminates the server and can create allocator-dependent heap     corruption. This issue is fixed in version 3.28.0. (CVE-2026-63652)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0,     planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that     a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes     declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update     whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while     processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed     in version 3.29.0. (CVE-2026-69159)

    A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose     sensitive information from the server or proxy process memory to a downstream client. This occurs because     certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek     instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap     memory that may contain cleartext credentials from previous sessions. (CVE-2026-85089)

    A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the     `general_ChromaV1ToYUV444` function during AVC444 chroma plane reconstruction. A remote attacker, acting     as a malicious Remote Desktop Protocol (RDP) server, can exploit this by sending a specially crafted     `RFX_AVC444_BITMAP_STREAM` with specific frame geometry. This can lead to an out-of-bounds memory read,     potentially disclosing sensitive heap data to the client or causing a client crash, resulting in a denial     of service. (CVE-2026-85090)

    FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders     that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send     oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap     objects, causing process termination. (CVE-2026-91945)

    FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's     ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format.
    Attackers can receive uninitialized heap memory including live pointers and GLib function addresses     transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address. (CVE-2026-91946)

    FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that     dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race     AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing     freed channel objects. (CVE-2026-91947)

    FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows     unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers     can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and     enter RDSTLS to bypass pre-authentication transport restrictions. (CVE-2026-91949)

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due     to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a     crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory     reads past the packet buffer, causing client crashes or heap disclosure in logs. (CVE-2026-91950)

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in     nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before     writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server     Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-     controlled content, causing denial of service or heap corruption before authentication completes.
    (CVE-2026-91953)

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's     func_get_ep_desc function that indexes interface arrays by position instead of protocol field     InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted     InterfaceNumber values to read past allocated heap memory and crash the client. (CVE-2026-91956)

    FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when     worker thread creation fails after device registration. Attackers can trigger thread creation failure     during channel setup to cause device pointer deallocation while devman retains a reference, leading to     crash or code execution. (CVE-2026-91957)

    FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files,     allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an     out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in     xfreerdp. (CVE-2026-91958)

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the     RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to     trigger an out-of-bounds read causing process abort. (CVE-2026-91959)

    FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request     path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP     server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable     assertion that terminates the client process. (CVE-2026-91961)

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc     USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized     heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory     corruption vulnerabilities. (CVE-2026-91963)

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when     processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious     RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed     512-byte buffer without validation, causing client crashes or potential code execution when chained with     memory disclosure. (CVE-2026-91964)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
363754	Oracle Linux 8 : freerdp (ELSA-2026-76747)	Nessus	Oracle Linux Local Security Checks	Local	high
363745	RockyLinux 8 : freerdp (RLSA-2026:76747)	Nessus	Rocky Linux Local Security Checks	Local	high
363385	RHEL 8 : freerdp (RHSA-2026:76747)	Nessus	Red Hat Local Security Checks	Local	high
363371	Oracle Linux 10 : freerdp (ELSA-2026-75570)	Nessus	Oracle Linux Local Security Checks	Local	high
363140	RockyLinux 10 : freerdp (RLSA-2026:75570)	Nessus	Rocky Linux Local Security Checks	Local	high
362966	RHEL 10 : freerdp (RHSA-2026:75570)	Nessus	Red Hat Local Security Checks	Local	high
351037	Amazon Linux 2 : freerdp (ALAS-2026-3938)	Nessus	Amazon Linux Local Security Checks	Local	high
346004	Linux Distros Unpatched Vulnerability : CVE-2026-91959	Nessus	Misc.	Local	high
345797	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2142)	Nessus	Amazon Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-91959

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

critical