CVE-2026-111376

A flaw was found in FreeRDP. When handling remote file clipboard transfers on Windows clients, the application fails to properly validate the length of file size responses returned by a Remote Desktop Protocol RDP server. A malicious RDP server can exploit this by returning an abnormally short...

openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

DEBIAN-CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to an unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled which is the default when not explicitl...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. In versions up to 0.10.5, xrdp does not implement verification for the Message Authentication Code MAC signature of encrypted RDP packets when using the “Classic RDP Security” layer. Although the sender correctly generates these signatures, the receiving side...

Rocky Linux 10.2 [CIQ] Security Update: gnome-remote-desktop / gnome-remote-desktop-debuginfo / etc (crlsa-2026_54512)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654512 advisory. gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 Tenable...

openSUSE 16 Security Update : gnome-remote-desktop (openSUSE-SU-2026:21888-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21888-1 advisory. This update for gnome-remote-desktop fixes the following issue: - CVE-2026-18358: system-mode RDP server missing connection throttling can allow...

Security update for gnome-remote-desktop (important)

openSUSE security update: security update for gnome-remote-desktop ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21888-1 Rating: important References: bsc1273354 Cross-References: CVE-2026-18358 CVSS scores: CVE-2026-18358 SUSE : 7.5...

OPENSUSE-SU-2026:21888-1 Security update for gnome-remote-desktop

This update for gnome-remote-desktop fixes the following issue: - CVE-2026-18358: system-mode RDP server missing connection throttling can allow unauthenticated denial of service bsc1273354...

freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol RDP server can exploit a heap buffer overflow vulnerability during Opus audio decoding. This occurs when the server negotiates Opus audio with a vulnerable client, causing the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109824 advisory. FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp...

CVE-2026-91962

A flaw was found in FreeRDP. An integer overflow in the audin Apple backends, specifically when processing FramesPerPacket values from MSGSNDINOPEN messages, allows a malicious RDP Remote Desktop Protocol server to supply crafted values. This can cause the AudioQueueAllocateBuffer size computatio...

CVE-2026-91956

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

CVE-2026-91954

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a null pointer dereference in the gdisurfacebits function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disable...

CVE-2026-91952

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send specially crafted AVC444 graphics updates. This can cause the pooldecoderect function to enter an infinite loop when decoding AVC444 metablocks with an excessive number of region rectangles. The vulnerability lea...

CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...

DEBIAN-CVE-2026-91953

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the LBLOADBALANCEINFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an...

EUVD-2026-78640

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...