The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54486 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow     (CVE-2026-64620)

    * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code     execution (CVE-2026-64621)

    * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)

    * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)

    * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)

    * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow     (CVE-2026-68580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54485 advisory.

    [2:2.11.7-11]
    - Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299,       CVE-2026-68580)       Resolves: RHEL-213173, RHEL-222796, RHEL-222972, RHEL-223606

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54487 advisory.

    [2:2.11.7-7.5]
    - Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299,       CVE-2026-68580)       Resolves: RHEL-213169, RHEL-222785, RHEL-222966, RHEL-223605

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54487 advisory.

    * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)

    * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)

    * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)

    * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow     (CVE-2026-68580)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58713 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)

    * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)

    * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)

    * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow     (CVE-2026-68580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3887 advisory.

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options,     exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with     /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or     expose local filesystems without user interaction. (CVE-2026-64624)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation     weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because     FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware     identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g.
    'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when     non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without     comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to     present such a certificate can bypass server identity verification, weakening TLS server authentication.
    (CVE-2026-66402)

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request     decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and     SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted     smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing     client process termination. (CVE-2026-67288)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the     server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's     ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy     CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised     RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary     headers/requests into the HTTP proxy CONNECT request. (CVE-2026-67289)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in     update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a     GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not     verify it fits within the remaining received buffer before allocating and copying that many bytes. A     malicious RDP server can send a short fragment with an oversized declared size, causing the client to read     beyond the allocated buffer, resulting in an out-of-bounds read and client crash. (CVE-2026-67291)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation     vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a     wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly     accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's     X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
    (CVE-2026-67293)

    FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate     during client-side server TLS authentication. In x509_utils_verify(), when server-purpose     (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose     verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the     RDP server certificate. In environments relying on EKU separation between client and server certificates,     this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose     validation. (CVE-2026-67294)

    FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection,     allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP     server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths     that bypass the shared-root boundary check. (CVE-2026-67295)

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler     (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header,     the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first     verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned     integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check     (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-     of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash     the server. Fixed in FreeRDP 3.29.0. (CVE-2026-67298)

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for     WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In     update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with     the parser-owned windowIcon->iconInfo pointer. After the parser callback returns,     update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and     later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window     Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption     and client crash. (CVE-2026-67299)

    FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message     proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a     malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies     structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects,     icon buffers). The parser frees those nested buffers after the callback returns, so the queued async     message later dispatches stale pointers, potentially causing memory corruption or a client crash.
    (CVE-2026-67300)

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for     the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-     update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy     point data from the address of the order structure instead of from polygonSC->points / polygonCB->points,     resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted     PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash. (CVE-2026-67301)

    FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE     bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in     libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0-15 attacker-     declared raw bytes are read without validating that the source buffer contains them. A malicious or     compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both     the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the     source buffer. The issue is fixed in FreeRDP 3.29.0. (CVE-2026-67306)

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel     (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket     parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size     wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
    (CVE-2026-68580)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
335175	RHEL 10 : freerdp (RHSA-2026:54486)	Nessus	Red Hat Local Security Checks	8/13/2026	8/21/2026	critical
335267	Oracle Linux 8 : freerdp (ELSA-2026-54485)	Nessus	Oracle Linux Local Security Checks	8/13/2026	8/21/2026	critical
335394	Oracle Linux 9 : freerdp (ELSA-2026-54487)	Nessus	Oracle Linux Local Security Checks	8/14/2026	8/21/2026	critical
335428	RockyLinux 9 : freerdp (RLSA-2026:54487)	Nessus	Rocky Linux Local Security Checks	8/14/2026	8/21/2026	critical
339153	RHEL 9 : freerdp (RHSA-2026:58713)	Nessus	Red Hat Local Security Checks	8/24/2026	8/28/2026	critical
341869	Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3887 (ALAS-2026-3887)	Nessus	Amazon Linux Local Security Checks	8/31/2026	8/31/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical