Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 之前3.32.0的 FreeRDP 2.0.0 在使用 WITH_LAME=ON 和 WITH_DSP_FFMPEG=OFF 建置時，在freerdp_dsp_decode_mp3中會發生堆積型緩衝區溢位，因為右通道 PCM 指標會因被視為短元素的位元組計數而位移。惡意 RDP 伺服器可以透過 rdpsnd 傳送 MP3 音訊，因此解碼的樣本會跨越堆積配置，從而使用戶端當機。（CVE-2026-110837）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 以 WITH_LAME=ON 和 WITH_DSP_FFMPEG=OFF 构建时，之前3.32.0的 FreeRDP 2.0.0 在 freerdp_dsp_decode_mp3 中存在基于堆的缓冲区溢出，因为右信道 PCM 指针被被视为短元素的字节计数偏移。恶意 RDP 服务器可通过 rdpsnd 发送 MP3 音频，因此解码示例会跨堆分配，从而造成客户端崩溃。（CVE-2026-110837）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 3.32.0より前のFreeRDP2.0.0、WITH_LAME=ONとWITH_DSP_FFMPEG=OFFでビルドすると、右チャンネルのPCMポインターが短い要素として扱われるバイトカウントによってオフセットされるため、freerdp_dsp_decode_mp3でヒープベースのバッファオーバーフローが発生します。悪意のある RDP サーバーが MP3 オーディオを rdpsnd 経由で送信できるため、デコードされたサンプルがヒープ割り当てを越えてクライアントをクラッシュさせる可能性があります。(CVE-2026-110837)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1205 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-111880:
    FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback     NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted     AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the     allocation.

    CVE-2026-111379:
    FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that     allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can     set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread     to overflow an undersized buffer and potentially execute code.

    CVE-2026-110839:
    FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds     write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather     than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard     redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.

    CVE-2026-110837:
    FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer     overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated     as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap     allocation, crashing the client.

    CVE-2026-109676:
    FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that     allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers     can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory     corruption or crashes.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer     overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated     as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap     allocation, crashing the client. (CVE-2026-110837)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
371842	Amazon Linux 2023：freerdp、freerdp-devel、freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high
371842	Amazon Linux 2023：freerdp、freerdp-devel、freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high
366132	Linux Distros 未修補弱點：CVE-2026-110837	Nessus	Misc.	10/15/2026	10/26/2026	medium
366132	Linux Distros 未修补的漏洞：CVE-2026-110837	Nessus	Misc.	10/15/2026	10/26/2026	medium
371842	Amazon Linux 2023 : freerdp、freerdp-devel、freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high
366132	Linux Distros のパッチ未適用の脆弱性: CVE-2026-110837	Nessus	Misc.	10/15/2026	10/26/2026	medium
371842	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high
372227	TencentOS Server 4: freerdp (TSSA-2026:1205)	Nessus	Tencent Local Security Checks	10/27/2026	10/27/2026	high
366132	Linux Distros Unpatched Vulnerability : CVE-2026-110837	Nessus	Misc.	10/15/2026	10/26/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

high

medium

high

high

medium