Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2053 advisory. FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client rand...

Oracle Linux 10 : freerdp (ELSA-2026-54486)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54486 advisory. 2:3.10.3-12.8 - Backport several CVE fixes CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580 Resolves:...

CVE-2026-64620

FreeRDP before 3.28.0 (affected out_length, enabling out-of-bounds writes prior to the bounds check. On the server side, when a client uses RDP Standard Security, the encrypted client random is decrypted into a fixed 32‑byte buffer. Because the server publishes its RSA public key, an unauthentic...