Detections
Analytics
CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791568721)
high Nessus Plugin ID 365367
Synopsis
The CentOS Linux host is missing one or more security updates.Description
The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791568721 advisory.- FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker- controlled content, causing denial of service or heap corruption before authentication completes.
(CVE-2026-91953)
- FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client. (CVE-2026-91956)
- FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution. (CVE-2026-91957)
- FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort. (CVE-2026-91959)
- FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities. (CVE-2026-91963)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1791568721.See Also
Plugin Details
Severity: High
ID: 365367
File Name: tuxcare_centos_7_CLSA-2026-1791568721.nasl
Version: 1.1
Type: Local
Agent: unix
Family: CentOS Local Security Checks
Published: 10/13/2026
Updated: 10/13/2026
Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.22
Vendor
Vendor Severity: Important
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2026-91963
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2026-91964
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 7.4
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-91964
Vulnerability Information
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/9/2026
Vulnerability Publication Date: 9/14/2026
Reference Information
CVE: CVE-2026-91953, CVE-2026-91956, CVE-2026-91957, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964
CLSA: 2026:1791568721