The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19358 advisory.

    - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952)       Resolves: RHEL-159860
    - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
    - Fix growth of preallocated buffers (CVE-2026-27951)
    - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
    - Add DSP format checks (CVE-2026-31884)
    - Fix DSP array bounds checks (CVE-2026-31883)
    - Fix DSP array bounds checks (CVE-2026-31885)
    - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)       Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482       Resolves: RHEL-161519, RHEL-161085, RHEL-168463
    - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 9 : freerdp (ELSA-2026-19358)

medium Nessus Plugin ID 322562

Version 1.2

Version 1.1

Version 1.2 Jul 13, 2026, 1:10 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber") Plugin Feed: 202607131310
Version 1.1 Jun 25, 2026, 4:10 AM New Plugin Feed: 202606250410