Vulnerability-Lookup

RHSA-2026:68707

Vulnerability from csaf_redhat - Published: 2026-09-17 19:08 - Updated: 2026-09-18 00:06

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Notes

Topic: An update for freerdp is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Denial of Service via malformed media data (CVE-2026-67290) * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298) * FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash (CVE-2026-55192) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-55192

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the client application to crash, resulting in a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 47 products

Product	Version	Remediation
Unresolved product id: 7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller `alloc_hint` value instead of the actual `StubLength` for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Important

CVE-2026-67288

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Moderate

CVE-2026-67290

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send specially crafted media data to a connected client. This malformed data can trigger a heap out-of-bounds read vulnerability within the TSMF FFmpeg decoder, leading to the client application crashing. This can result in a denial of service for the client.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Moderate

CVE-2026-67291

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Moderate

CVE-2026-67298

A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol (RDP) packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the FreeRDP server, leading to a denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CWE-191 - Integer Underflow (Wrap or Wraparound)

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Important

CVE-2026-67301

A flaw was found in FreeRDP. When the `async-update` feature is enabled, a malicious or compromised Remote Desktop Protocol (RDP) server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to crash, resulting in a Denial of Service.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 47 products, the same list as for CVE-2026-55192

Threats

Impact Moderate

References

58 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68707	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509984	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509994	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510001	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510010	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510041	external
https://bugzilla.redhat.com/show_bug.cgi?id=2519823	external
https://bugzilla.redhat.com/show_bug.cgi?id=2519824	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-55192	self
https://bugzilla.redhat.com/show_bug.cgi?id=2519823	external
https://www.cve.org/CVERecord?id=CVE-2026-55192	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55192	external
https://github.com/FreeRDP/FreeRDP/commit/0cd45b7…	external
https://github.com/FreeRDP/FreeRDP/pull/12873	external
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-55194	self
https://bugzilla.redhat.com/show_bug.cgi?id=2519824	external
https://www.cve.org/CVERecord?id=CVE-2026-55194	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55194	external
https://github.com/FreeRDP/FreeRDP/commit/9f2da52…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-67288	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510001	external
https://www.cve.org/CVERecord?id=CVE-2026-67288	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67288	external
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	external
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-67290	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509984	external
https://www.cve.org/CVERecord?id=CVE-2026-67290	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67290	external
https://github.com/FreeRDP/FreeRDP/commit/8d3b860…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-67291	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510010	external
https://www.cve.org/CVERecord?id=CVE-2026-67291	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67291	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-67298	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510041	external
https://www.cve.org/CVERecord?id=CVE-2026-67298	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67298	external
https://github.com/FreeRDP/FreeRDP/commit/4684876…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-heap…	external
https://access.redhat.com/security/cve/CVE-2026-67301	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509994	external
https://www.cve.org/CVERecord?id=CVE-2026-67301	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67301	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for freerdp is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* FreeRDP: FreeRDP: Denial of Service via malformed media data (CVE-2026-67290)\n\n* FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n\n* FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n\n* FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n\n* FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)\n\n* FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash (CVE-2026-55192)\n\n* FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68707",
        "url": "https://access.redhat.com/errata/RHSA-2026:68707"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2509984",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509984"
      },
      {
        "category": "external",
        "summary": "2509994",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509994"
      },
      {
        "category": "external",
        "summary": "2510001",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510001"
      },
      {
        "category": "external",
        "summary": "2510010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510010"
      },
      {
        "category": "external",
        "summary": "2510041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510041"
      },
      {
        "category": "external",
        "summary": "2519823",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519823"
      },
      {
        "category": "external",
        "summary": "2519824",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519824"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68707.json"
      }
    ],
    "title": "Red Hat Security Advisory: freerdp security update",
    "tracking": {
      "current_release_date": "2026-09-18T00:06:22+00:00",
      "generator": {
        "date": "2026-09-18T00:06:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:68707",
      "initial_release_date": "2026-09-17T19:08:22+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T19:08:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T19:08:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-18T00:06:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                  "product_id": "7Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
                  "product_id": "7Server-optional-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-0:2.1.1-5.el7_9.12.src",
                "product": {
                  "name": "freerdp-0:2.1.1-5.el7_9.12.src",
                  "product_id": "freerdp-0:2.1.1-5.el7_9.12.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.1.1-5.el7_9.12?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "freerdp-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "freerdp-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.i686",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.i686",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.i686",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.i686",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.i686",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.i686",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "freerdp-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "freerdp-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=ppc64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "freerdp-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "freerdp-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390",
                "product": {
                  "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390",
                  "product_id": "freerdp-libs-0:2.1.1-5.el7_9.12.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.1.1-5.el7_9.12?arch=s390"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-0:2.1.1-5.el7_9.12.s390",
                "product": {
                  "name": "libwinpr-0:2.1.1-5.el7_9.12.s390",
                  "product_id": "libwinpr-0:2.1.1-5.el7_9.12.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.1.1-5.el7_9.12?arch=s390"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
                "product": {
                  "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
                  "product_id": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.1.1-5.el7_9.12?arch=s390"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390",
                "product": {
                  "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390",
                  "product_id": "freerdp-devel-0:2.1.1-5.el7_9.12.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.1.1-5.el7_9.12?arch=s390"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
                "product": {
                  "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
                  "product_id": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.1.1-5.el7_9.12?arch=s390"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "freerdp-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "freerdp-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "freerdp-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-0:2.1.1-5.el7_9.12.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src"
        },
        "product_reference": "freerdp-0:2.1.1-5.el7_9.12.src",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "freerdp-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "libwinpr-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
        "relates_to_product_reference": "7Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
          "product_id": "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        },
        "product_reference": "libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64",
        "relates_to_product_reference": "7Server-optional-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55192",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-19T18:01:11.541636+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can provide a specially crafted H.264 video stream that causes the client\u0027s H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the client application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An out-of-bounds memory read flaw was found in FreeRDP\u0027s H.264 video decoder (`libfreerdp/codec/h264.c`). When handling AVC420 or AVC444 bitstreams, decoder backends fail to validate frame dimensions against negotiated RDPGFX surface boundaries. A malicious RDP server can send a video frame smaller than the surface, causing `yuv420_context_decode` and YUV-to-RGB conversion paths to read past allocated memory buffers. This allows an untrusted server to exfiltrate sensitive client memory contents or crash the client application.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55192"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6"
        }
      ],
      "release_date": "2026-08-19T17:51:19.479000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable H.264 graphics acceleration in client connection parameters (e.g., omitting `/gfx:avc420` or `/gfx:avc444` in `xfreerdp`) to force legacy RemoteFX or standard software bitmap rendering.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash"
    },
    {
      "cve": "CVE-2026-55194",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-08-19T18:01:17.676363+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller `alloc_hint` value instead of the actual `StubLength` for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow flaw was found in FreeRDP\u0027s TS Gateway RPC client (`libfreerdp/core/gateway/rpc_client.c`). During response fragment reassembly in `rpc_client_recv_fragment`, stream allocation relies on the server-provided `alloc_hint` rather than the actual `StubLength`. A malicious TS Gateway can send a `PTYPE_RESPONSE` packet with a small `alloc_hint` and a larger payload, causing `Stream_Write` to overwrite memory beyond the fixed 4096-byte buffer (`pdu-\u003es`). This can result in client crashes or potential arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55194",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55194",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx"
        }
      ],
      "release_date": "2026-08-19T17:50:30.158000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, avoid connecting through untrusted TS Gateways (RD Gateways) or disable gateway parameters (such as omitting `/g:` in `xfreerdp`) to force direct RDP connections and bypass RPC response parsing.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response"
    },
    {
      "cve": "CVE-2026-67288",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-01T13:02:16.978525+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510001"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate denial of service flaw affects FreeRDP in Red Hat products. When smartcard emulation is enabled, a remote attacker can exploit this vulnerability by sending malformed smartcard cache requests, leading to a null pointer dereference and subsequent termination of the FreeRDP client process. This can disrupt active remote desktop sessions for affected users.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510001",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510001"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
        }
      ],
      "release_date": "2026-08-01T12:22:18.305000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "If smartcard redirection/emulation is unused, do not enable it (omit /smartcard and /smartcard-logon, or start with /smartcard:off). Only connect FreeRDP clients to trusted RDP endpoints",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests"
    },
    {
      "cve": "CVE-2026-67290",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-01T13:01:21.601148+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509984"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send specially crafted media data to a connected client. This malformed data can trigger a heap out-of-bounds read vulnerability within the TSMF FFmpeg decoder, leading to the client application crashing. This can result in a denial of service for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via malformed media data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in FreeRDP is rated as Important. A FreeRDP client connecting to a malicious or untrusted RDP server can be subjected to a denial of service. The flaw stems from a heap out-of-bounds read within the TSMF FFmpeg decoder when processing malformed media data, leading to client application crashes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509984",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509984"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67290"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf"
        }
      ],
      "release_date": "2026-08-01T12:22:16.590000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the Terminal Services Multimedia Redirection (TSMF) feature when connecting to untrusted RDP servers. This prevents the vulnerable media processing from being engaged.\n\nFor `xfreerdp` clients, use the `/disable-tsmf` or `/tsmf:off` command-line option:\n\n`xfreerdp /disable-tsmf \u003cserver_address\u003e`\n\nDisabling TSMF will prevent multimedia content from being redirected during the RDP session.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via malformed media data"
    },
    {
      "cve": "CVE-2026-67291",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-01T13:02:45.885457+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate heap out-of-bounds read in FreeRDP affects Red Hat products by allowing an untrusted RDP server to remotely crash a connecting client without authentication, resulting in a loss of application availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67291",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67291",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add"
        }
      ],
      "release_date": "2026-08-01T12:22:18.322000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid connecting FreeRDP clients to untrusted or potentially malicious RDP servers. If such connections are required, run the client on a dedicated, isolated system so a client crash is contained and does not impact other workloads.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read"
    },
    {
      "cve": "CVE-2026-67298",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-08-01T13:04:25.188753+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol (RDP) packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the FreeRDP server, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. A heap buffer overflow in the FreeRDP server-side RAIL channel handler can be exploited by a malicious or compromised RDP client, leading to a denial of service. This vulnerability impacts the availability of remote desktop services on Red Hat systems by causing the RDP server to crash. Exploitation requires the RDP server to be active and reachable by an attacker.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67298"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67298",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67298"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67298",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67298"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow",
          "url": "https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow"
        }
      ],
      "release_date": "2026-08-01T12:22:18.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue do not expose FreeRDP server/proxy/shadow (freerdp-shadow-cli / freerdp-proxy) to untrusted networks\u2014allow only trusted clients via firewall, or disable those services if unused.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling"
    },
    {
      "cve": "CVE-2026-67301",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-01T13:01:53.731118+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509994"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. When the `async-update` feature is enabled, a malicious or compromised Remote Desktop Protocol (RDP) server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to crash, resulting in a Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate out-of-bounds read flaw in FreeRDP allows a malicious server to cause memory disclosure or crash the client, but only when the non-default async-update feature is explicitly enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
          "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
          "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
          "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509994",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509994"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67301",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67301",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy"
        }
      ],
      "release_date": "2026-08-01T12:22:16.955000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T19:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68707"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the `async-update` feature when using FreeRDP clients. This feature is not enabled by default. If `xfreerdp` is used, ensure the `/async-update` command-line option is not specified. Disabling this feature may impact performance in certain RDP sessions where asynchronous updates are beneficial.",
          "product_ids": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.src",
            "7Server-ELS:freerdp-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:freerdp-libs-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.i686",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.s390x",
            "7Server-ELS:libwinpr-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-debuginfo-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:freerdp-devel-0:2.1.1-5.el7_9.12.x86_64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.i686",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.ppc64le",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.s390x",
            "7Server-optional-ELS:libwinpr-devel-0:2.1.1-5.el7_9.12.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders"
    }
  ]
}

CVE-2026-55192 (GCVE-0-2026-55192)

Vulnerability from cvelistv5 – Published: 2026-08-19 17:51 – Updated: 2026-08-25 03:36

Title

FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 03:35 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/pull/12873	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/commit/0cd45b7…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.27.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55192",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T03:35:48.995314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T03:36:30.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:51:19.479Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3mmf-qh4f-frm6",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55192",
    "datePublished": "2026-08-19T17:51:19.479Z",
    "dateReserved": "2026-06-16T15:20:43.086Z",
    "dateUpdated": "2026-08-25T03:36:30.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55194 (GCVE-0-2026-55194)

Vulnerability from cvelistv5 – Published: 2026-08-19 17:50 – Updated: 2026-08-27 16:25

Title

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 03:55 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/pull/12873	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/commit/9f2da52…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.27.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55194",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T03:55:49.884406Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T16:25:00.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu-\u003es buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:50:30.158Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9gxm-3mf5-f5cx",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55194",
    "datePublished": "2026-08-19T17:50:30.158Z",
    "dateReserved": "2026-06-16T15:20:43.087Z",
    "dateUpdated": "2026-08-27T16:25:00.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67288 (GCVE-0-2026-67288)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 19:49

Title

FreeRDP before 3.29.0 Denial of Service via smartcard cache

Summary

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:47 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	patch
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory
https://github.com/FreeRDP/FreeRDP/security/advis…	exploit

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67288",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:47:44.966327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:49:39.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.305Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
        }
      ],
      "title": "FreeRDP before 3.29.0 Denial of Service via smartcard cache",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67288",
    "datePublished": "2026-08-01T12:22:18.305Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T19:49:39.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67290 (GCVE-0-2026-67290)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 15:38

Title

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

Summary

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:00 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/8d3b860…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:00:32.243529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:38:23.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:16.590Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-whq8-c3v3-p8v8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf"
        }
      ],
      "title": "FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67290",
    "datePublished": "2026-08-01T12:22:16.590Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T15:38:23.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67291 (GCVE-0-2026-67291)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 14:56

Title

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

Summary

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 14:56 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67291",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:56:02.777922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T14:56:19.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 (affected versions \u003c= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.322Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hgj8-g595-wfc6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add"
        }
      ],
      "title": "FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67291",
    "datePublished": "2026-08-01T12:22:18.322Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T14:56:19.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67298 (GCVE-0-2026-67298)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 19:50

Title

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

Summary

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:50 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://github.com/FreeRDP/FreeRDP/commit/4684876…	patch
https://www.vulncheck.com/advisories/freerdp-heap…	third-party-advisory
https://github.com/FreeRDP/FreeRDP/security/advis…	exploit

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67298",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:50:25.787082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:50:59.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.323Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qmvw-52ph-q5pv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow"
        }
      ],
      "title": "FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67298",
    "datePublished": "2026-08-01T12:22:18.323Z",
    "dateReserved": "2026-07-29T13:04:41.947Z",
    "dateUpdated": "2026-08-03T19:50:59.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67301 (GCVE-0-2026-67301)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 18:23

Title

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

Summary

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 18:23 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67301",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T18:23:42.208706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T18:23:49.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC-\u003epoints / polygonCB-\u003epoints, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:16.955Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vxp3-7g6q-rq2w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy"
        }
      ],
      "title": "FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67301",
    "datePublished": "2026-08-01T12:22:16.955Z",
    "dateReserved": "2026-07-29T13:04:41.947Z",
    "dateUpdated": "2026-08-03T18:23:49.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68707

CVE-2026-55192 (GCVE-0-2026-55192)

CVE-2026-55194 (GCVE-0-2026-55194)

CVE-2026-67288 (GCVE-0-2026-67288)

CVE-2026-67290 (GCVE-0-2026-67290)

CVE-2026-67291 (GCVE-0-2026-67291)

CVE-2026-67298 (GCVE-0-2026-67298)

CVE-2026-67301 (GCVE-0-2026-67301)

Tags

Sightings

Nomenclature

Related by attack behaviour