rpm package
opensuse/freerdp2&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/freerdp2&distro=openSUSE%20Leap%2016.0
Vulnerabilities (17)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-24684 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.2 | ||
| CVE-2026-24683 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to | ||
| CVE-2026-24682 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0. | ||
| CVE-2026-24681 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0. | ||
| CVE-2026-24679 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. | ||
| CVE-2026-24676 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in | ||
| CVE-2026-24675 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0 | ||
| CVE-2026-24491 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0. | ||
| CVE-2026-23534 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server ca | ||
| CVE-2026-23532 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious | ||
| CVE-2026-23531 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via cr | ||
| CVE-2026-23530 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffe | ||
| CVE-2026-22859 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read | ||
| CVE-2026-22856 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1. | ||
| CVE-2026-22854 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to | ||
| CVE-2026-22852 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across mu | ||
| CVE-2024-22211 | — | < 2.11.7-bp160.2.1 | 2.11.7-bp160.2.1 | Jan 19, 2024 | FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and prox |
- CVE-2026-24684Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.2
- CVE-2026-24683Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to
- CVE-2026-24682Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
- CVE-2026-24681Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.
- CVE-2026-24679Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
- CVE-2026-24676Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in
- CVE-2026-24675Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0
- CVE-2026-24491Feb 9, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.
- CVE-2026-23534Jan 19, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server ca
- CVE-2026-23532Jan 19, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious
- CVE-2026-23531Jan 19, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via cr
- CVE-2026-23530Jan 19, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffe
- CVE-2026-22859Jan 14, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read
- CVE-2026-22856Jan 14, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2026-22854Jan 14, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to
- CVE-2026-22852Jan 14, 2026affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across mu
- CVE-2024-22211Jan 19, 2024affected < 2.11.7-bp160.2.1fixed 2.11.7-bp160.2.1
FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and prox