The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1771010890 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server     can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format     lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and     writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability     is fixed in 3.20.1. (CVE-2026-22852)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does     not perform bounds checking on serversupplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices     in libusb_udev_complete_msconfig_setup, causing an outofbounds read. This vulnerability is fixed in     3.20.1. (CVE-2026-22859)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec,     when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating     the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A     malicious server can trigger a clientside heap buffer overflow, causing a crash (DoS) and potential heap     corruption with codeexecution risk depending on allocator behavior and surrounding heap layout. Version     3.21.0 contains a patch for the issue. (CVE-2026-23531)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph     parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`.
    A malicious server can trigger a clientside global buffer overflow, causing a crash (DoS). Version 3.21.0     contains a patch for the issue. (CVE-2026-23732)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New`     frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again,     triggering ASan UAF. A malicious server can trigger a clientside use after free, causing a crash (DoS)     and potential heap corruption with codeexecution risk depending on allocator behavior and surrounding     heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1771010890)

high Nessus Plugin ID 361336

Version 1.2

Version 1.1

Version 1.2 Nov 6, 2026, 2:22 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber". "Cvssv4 threat score" set to 6.6) Plugin Feed: 202611061422
Version 1.1 Oct 1, 2026, 9:59 PM New Plugin Feed: 202610012159