rpm package
suse/freerdp2&distro=SUSE Linux Enterprise Workstation Extension 15 SP7
pkg:rpm/suse/freerdp2&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-31885 | Med | 6.5 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0. | |
| CVE-2026-31883 | Med | 6.5 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtr | |
| CVE-2026-31806 | Cri | 9.8 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server | |
| CVE-2026-26965 | Hig | 8.8 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Feb 25, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in t | |
| CVE-2026-26955 | Hig | 8.8 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Feb 25, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of- | |
| CVE-2026-26271 | Med | 5.3 | < 2.11.7-150700.3.14.1 | 2.11.7-150700.3.14.1 | Feb 25, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachable over the network w | |
| CVE-2026-24684 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.2 | |
| CVE-2026-24683 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to | |
| CVE-2026-24682 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0. | |
| CVE-2026-24681 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0. | |
| CVE-2026-24679 | Cri | 9.1 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. | |
| CVE-2026-24676 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in | |
| CVE-2026-24675 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0 | |
| CVE-2026-24491 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Feb 9, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0. | |
| CVE-2026-23884 | Cri | 9.8 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing | |
| CVE-2026-23883 | Cri | 9.8 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after | |
| CVE-2026-23732 | Hig | 7.5 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causi | |
| CVE-2026-23534 | Cri | 9.8 | < 2.11.7-150700.3.3.1 | 2.11.7-150700.3.3.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server ca | |
| CVE-2026-23533 | Cri | 9.8 | < 2.11.7-150700.3.8.1 | 2.11.7-150700.3.8.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can | |
| CVE-2026-23532 | Cri | 9.8 | < 2.11.7-150700.3.3.1 | 2.11.7-150700.3.3.1 | Jan 19, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious |
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtr
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in t
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-
- affected < 2.11.7-150700.3.14.1fixed 2.11.7-150700.3.14.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachable over the network w
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.2
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causi
- affected < 2.11.7-150700.3.3.1fixed 2.11.7-150700.3.3.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server ca
- affected < 2.11.7-150700.3.8.1fixed 2.11.7-150700.3.8.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can
- affected < 2.11.7-150700.3.3.1fixed 2.11.7-150700.3.3.1
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious
Page 1 of 2