The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits()     function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using     NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the     actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that     exceed the expected surface size. Because these values are used during bitmap decoding and memory     operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can     also control the associated pixel data transmitted by the server, the overflow may be exploitable to     overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0. (CVE-2026-31806)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31806

critical Nessus Plugin ID 302239

Version 1.5