The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16019 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16866 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-628:18 advisory.

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
      * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
      * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity     (CVE-2026-27951)
      * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
      * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index     bounds checks (CVE-2026-31885)
      * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)
      * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
      * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19358 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19358 advisory.

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1208:22 advisory.

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
      * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
      * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity     (CVE-2026-27951)
      * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
      * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index     bounds checks (CVE-2026-31885)
      * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)
      * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
      * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1774438942 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0. (CVE-2026-29775)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0. (CVE-2026-31884)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
314253	RHEL 8 : freerdp (RHSA-2026:16019)	Nessus	Red Hat Local Security Checks	5/11/2026	5/11/2026	medium
314493	RHEL 9 : freerdp (RHSA-2026:16866)	Nessus	Red Hat Local Security Checks	5/13/2026	6/4/2026	medium
315126	MiracleLinux 9 : freerdp-2.11.7-1.el9_7.7 (AXSA:2026-628:18)	Nessus	Miracle Linux Local Security Checks	5/18/2026	6/4/2026	medium
315474	RHEL 9 : freerdp (RHSA-2026:19358)	Nessus	Red Hat Local Security Checks	5/19/2026	6/2/2026	medium
317421	RockyLinux 9 : freerdp (RLSA-2026:19358)	Nessus	Rocky Linux Local Security Checks	5/28/2026	5/28/2026	medium
325449	MiracleLinux 9 : freerdp-2.11.7-7.el9_8.3 (AXSA:2026-1208:22)	Nessus	Miracle Linux Local Security Checks	7/7/2026	7/8/2026	medium
361144	CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1774438942)	Nessus	CentOS Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high