The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-29774

high Nessus Plugin ID 302240

Version 1.7