Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3307)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3307 advisory. FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values...

CLSA-2026-1792155691 freerdp: Fix of 2 CVEs

CVE-2026-109242: allocate the aligned buffers behind progressive tiles, RemoteFX tiles, GDI surfaces and glyph conversion with alignedrecalloc instead of alignedmalloc, so an un-decoded progressive tile can no longer render uninitialized heap memory...

Linux Distros Unpatched Vulnerability : CVE-2026-109242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792155691)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792155691 advisory. - FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM...

CLSA-2026-1792157679 freerdp: Fix of CVE-2026-109242

CVE-2026-109242: allocate the aligned buffers behind progressive tiles, RemoteFX tiles, GDI surfaces and glyph conversion with alignedrecalloc instead of alignedmalloc, so an un-decoded progressive tile can no longer render uninitialized heap memory...

CVE-2026-109242

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...

CVE-2026-109242

FreeRDP versions prior to 3.0.0 and 3.6.0 (before 3.32.0 ) are vulnerable to an uninitialized heap disclosure via a progressive codec tile upgrade. The root cause is that the tile->current buffer is allocated without being zeroed out. A malicious RDP server can exploit this by sending a crafte...