The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf4c5bb9c5 advisory.

    Automatic update for freerdp-3.24.0-1.fc45.

    ##### **Changelog**

    ```
    * Mon Mar 16 2026 Ondrej Holy <oholy@redhat.com> - 2:3.24.0-1
    - Update to 3.24.0 (CVE-2026-29774, CVE-2026-29775, CVE-2026-29776,       CVE-2026-31806, CVE-2026-31883, CVE-2026-31884, CVE-2026-31885,       CVE-2026-31897)       Resolves: rhbz#2447295, rhbz#2447393, rhbz#2447412, rhbz#2447415       Resolves: rhbz#2447417, rhbz#2447419, rhbz#2447423, rhbz#2447428       Resolves: rhbz#2447431

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-07418a381f advisory.

    Update to 3.24.2

    It fixes CVE-2026-33952, CVE-2026-33977, CVE-2026-33982, CVE-2026-33983,     CVE-2026-33984, CVE-2026-33985, CVE-2026-33986, CVE-2026-33987 and     CVE-2026-33995.

    ----

    Update to 3.24.0 (CVE-2026-29774, CVE-2026-29775, CVE-2026-29776, CVE-2026-31806, CVE-2026-31883,     CVE-2026-31884, CVE-2026-31885, CVE-2026-31897)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2c1ab5b23b advisory.

    Update to 3.24.0 (CVE-2026-29774, CVE-2026-29775, CVE-2026-29776, CVE-2026-31806, CVE-2026-31883,     CVE-2026-31884, CVE-2026-31885, CVE-2026-31897)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1520 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates.  In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0. (CVE-2026-29775)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in     update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
    (CVE-2026-29776)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0. (CVE-2026-31883)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0. (CVE-2026-31884)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0. (CVE-2026-31885)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which     points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL,     this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
    (CVE-2026-31897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1635-1 advisory.

    - CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU     (bsc#1258919).
    - CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
    - CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
    - CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
    - CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
    - CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
    - CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
    - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
    - CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
    - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
    - CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
    - CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
    - CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1633-1 advisory.

    - CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU     (bsc#1258919).
    - CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
    - CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
    - CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
    - CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
    - CVE-2026-25955: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258973).
    - CVE-2026-25959: Heap-use-after-free in `xf_cliprdr_provide_data_` (bsc#1258976).
    - CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
    - CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
    - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
    - CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability     (bsc#1258941).
    - CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
    - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
    - CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
    - CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
    - CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3239 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates.  In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0. (CVE-2026-29775)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in     update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
    (CVE-2026-29776)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0. (CVE-2026-31883)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0. (CVE-2026-31884)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0. (CVE-2026-31885)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which     points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL,     this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
    (CVE-2026-31897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-34886abfad advisory.

    Update to 3.24.0 (CVE-2026-29774, CVE-2026-29775, CVE-2026-29776, CVE-2026-31806, CVE-2026-31883,     CVE-2026-31884, CVE-2026-31885, CVE-2026-31897)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1632-1 advisory.

    - CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU     (bsc#1258919).
    - CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
    - CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
    - CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
    - CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
    - CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
    - CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
    - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
    - CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
    - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
    - CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
    - CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
    - CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1634-1 advisory.

    - CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU     (bsc#1258919).
    - CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
    - CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
    - CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
    - CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
    - CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
    - CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
    - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
    - CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
    - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
    - CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
    - CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
    - CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
302502	Fedora 45 : freerdp (2026-bf4c5bb9c5)	Nessus	Fedora Local Security Checks	3/16/2026	4/3/2026	critical
304936	Fedora 42 : freerdp (2026-07418a381f)	Nessus	Fedora Local Security Checks	4/5/2026	4/5/2026	critical
303772	Fedora 44 : freerdp (2026-2c1ab5b23b)	Nessus	Fedora Local Security Checks	3/26/2026	4/3/2026	critical
304610	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1520)	Nessus	Amazon Linux Local Security Checks	4/1/2026	4/1/2026	critical
310647	SUSE SLES12 Security Update : freerdp (SUSE-SU-2026:1635-1)	Nessus	SuSE Local Security Checks	4/28/2026	4/28/2026	medium
302240	Linux Distros Unpatched Vulnerability : CVE-2026-29774	Nessus	Misc.	3/13/2026	4/29/2026	high
310650	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2026:1633-1)	Nessus	SuSE Local Security Checks	4/28/2026	4/28/2026	medium
306278	Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3239 (ALAS-2026-3239)	Nessus	Amazon Linux Local Security Checks	4/14/2026	4/14/2026	critical
303801	Fedora 43 : freerdp (2026-34886abfad)	Nessus	Fedora Local Security Checks	3/26/2026	4/3/2026	critical
310648	SUSE SLES15 Security Update : freerdp (SUSE-SU-2026:1632-1)	Nessus	SuSE Local Security Checks	4/28/2026	4/28/2026	medium
310649	SUSE SLES15 Security Update : freerdp (SUSE-SU-2026:1634-1)	Nessus	SuSE Local Security Checks	4/28/2026	4/28/2026	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium

high

medium

critical

critical

medium

medium