OPENSUSE-SU-2026:10459-1
Vulnerability from csaf_opensuse - Published: 2026-03-29 00:00 - Updated: 2026-03-29 00:00Summary
freerdp2-2.11.7-6.1 on GA media
Severity
Moderate
Notes
Title of the patch: freerdp2-2.11.7-6.1 on GA media
Description of the patch: These are all security issues fixed in the freerdp2-2.11.7-6.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10459
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.8 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.3 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "freerdp2-2.11.7-6.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the freerdp2-2.11.7-6.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-10459",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10459-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-22855 page",
"url": "https://www.suse.com/security/cve/CVE-2026-22855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-22857 page",
"url": "https://www.suse.com/security/cve/CVE-2026-22857/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23533 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23533/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23732 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23732/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23883 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23883/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23884 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23884/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-26271 page",
"url": "https://www.suse.com/security/cve/CVE-2026-26271/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-26955 page",
"url": "https://www.suse.com/security/cve/CVE-2026-26955/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-26965 page",
"url": "https://www.suse.com/security/cve/CVE-2026-26965/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31806 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31806/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31883 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31883/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31885 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31885/"
}
],
"title": "freerdp2-2.11.7-6.1 on GA media",
"tracking": {
"current_release_date": "2026-03-29T00:00:00Z",
"generator": {
"date": "2026-03-29T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:10459-1",
"initial_release_date": "2026-03-29T00:00:00Z",
"revision_history": [
{
"date": "2026-03-29T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "freerdp2-2.11.7-6.1.aarch64",
"product": {
"name": "freerdp2-2.11.7-6.1.aarch64",
"product_id": "freerdp2-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "freerdp2-devel-2.11.7-6.1.aarch64",
"product": {
"name": "freerdp2-devel-2.11.7-6.1.aarch64",
"product_id": "freerdp2-devel-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "freerdp2-proxy-2.11.7-6.1.aarch64",
"product": {
"name": "freerdp2-proxy-2.11.7-6.1.aarch64",
"product_id": "freerdp2-proxy-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "freerdp2-server-2.11.7-6.1.aarch64",
"product": {
"name": "freerdp2-server-2.11.7-6.1.aarch64",
"product_id": "freerdp2-server-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "libfreerdp2-2-2.11.7-6.1.aarch64",
"product": {
"name": "libfreerdp2-2-2.11.7-6.1.aarch64",
"product_id": "libfreerdp2-2-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "libwinpr2-2-2.11.7-6.1.aarch64",
"product": {
"name": "libwinpr2-2-2.11.7-6.1.aarch64",
"product_id": "libwinpr2-2-2.11.7-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "winpr2-devel-2.11.7-6.1.aarch64",
"product": {
"name": "winpr2-devel-2.11.7-6.1.aarch64",
"product_id": "winpr2-devel-2.11.7-6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp2-2.11.7-6.1.ppc64le",
"product": {
"name": "freerdp2-2.11.7-6.1.ppc64le",
"product_id": "freerdp2-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "freerdp2-devel-2.11.7-6.1.ppc64le",
"product": {
"name": "freerdp2-devel-2.11.7-6.1.ppc64le",
"product_id": "freerdp2-devel-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "freerdp2-proxy-2.11.7-6.1.ppc64le",
"product": {
"name": "freerdp2-proxy-2.11.7-6.1.ppc64le",
"product_id": "freerdp2-proxy-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "freerdp2-server-2.11.7-6.1.ppc64le",
"product": {
"name": "freerdp2-server-2.11.7-6.1.ppc64le",
"product_id": "freerdp2-server-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libfreerdp2-2-2.11.7-6.1.ppc64le",
"product": {
"name": "libfreerdp2-2-2.11.7-6.1.ppc64le",
"product_id": "libfreerdp2-2-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libwinpr2-2-2.11.7-6.1.ppc64le",
"product": {
"name": "libwinpr2-2-2.11.7-6.1.ppc64le",
"product_id": "libwinpr2-2-2.11.7-6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "winpr2-devel-2.11.7-6.1.ppc64le",
"product": {
"name": "winpr2-devel-2.11.7-6.1.ppc64le",
"product_id": "winpr2-devel-2.11.7-6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp2-2.11.7-6.1.s390x",
"product": {
"name": "freerdp2-2.11.7-6.1.s390x",
"product_id": "freerdp2-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "freerdp2-devel-2.11.7-6.1.s390x",
"product": {
"name": "freerdp2-devel-2.11.7-6.1.s390x",
"product_id": "freerdp2-devel-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "freerdp2-proxy-2.11.7-6.1.s390x",
"product": {
"name": "freerdp2-proxy-2.11.7-6.1.s390x",
"product_id": "freerdp2-proxy-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "freerdp2-server-2.11.7-6.1.s390x",
"product": {
"name": "freerdp2-server-2.11.7-6.1.s390x",
"product_id": "freerdp2-server-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "libfreerdp2-2-2.11.7-6.1.s390x",
"product": {
"name": "libfreerdp2-2-2.11.7-6.1.s390x",
"product_id": "libfreerdp2-2-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "libwinpr2-2-2.11.7-6.1.s390x",
"product": {
"name": "libwinpr2-2-2.11.7-6.1.s390x",
"product_id": "libwinpr2-2-2.11.7-6.1.s390x"
}
},
{
"category": "product_version",
"name": "winpr2-devel-2.11.7-6.1.s390x",
"product": {
"name": "winpr2-devel-2.11.7-6.1.s390x",
"product_id": "winpr2-devel-2.11.7-6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "freerdp2-2.11.7-6.1.x86_64",
"product": {
"name": "freerdp2-2.11.7-6.1.x86_64",
"product_id": "freerdp2-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "freerdp2-devel-2.11.7-6.1.x86_64",
"product": {
"name": "freerdp2-devel-2.11.7-6.1.x86_64",
"product_id": "freerdp2-devel-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "freerdp2-proxy-2.11.7-6.1.x86_64",
"product": {
"name": "freerdp2-proxy-2.11.7-6.1.x86_64",
"product_id": "freerdp2-proxy-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "freerdp2-server-2.11.7-6.1.x86_64",
"product": {
"name": "freerdp2-server-2.11.7-6.1.x86_64",
"product_id": "freerdp2-server-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "libfreerdp2-2-2.11.7-6.1.x86_64",
"product": {
"name": "libfreerdp2-2-2.11.7-6.1.x86_64",
"product_id": "libfreerdp2-2-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "libwinpr2-2-2.11.7-6.1.x86_64",
"product": {
"name": "libwinpr2-2-2.11.7-6.1.x86_64",
"product_id": "libwinpr2-2-2.11.7-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "winpr2-devel-2.11.7-6.1.x86_64",
"product": {
"name": "winpr2-devel-2.11.7-6.1.x86_64",
"product_id": "winpr2-devel-2.11.7-6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64"
},
"product_reference": "freerdp2-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le"
},
"product_reference": "freerdp2-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x"
},
"product_reference": "freerdp2-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64"
},
"product_reference": "freerdp2-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-devel-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64"
},
"product_reference": "freerdp2-devel-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-devel-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le"
},
"product_reference": "freerdp2-devel-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-devel-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x"
},
"product_reference": "freerdp2-devel-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-devel-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64"
},
"product_reference": "freerdp2-devel-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-proxy-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64"
},
"product_reference": "freerdp2-proxy-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-proxy-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le"
},
"product_reference": "freerdp2-proxy-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-proxy-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x"
},
"product_reference": "freerdp2-proxy-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-proxy-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64"
},
"product_reference": "freerdp2-proxy-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-server-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64"
},
"product_reference": "freerdp2-server-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-server-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le"
},
"product_reference": "freerdp2-server-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-server-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x"
},
"product_reference": "freerdp2-server-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "freerdp2-server-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64"
},
"product_reference": "freerdp2-server-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libfreerdp2-2-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64"
},
"product_reference": "libfreerdp2-2-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libfreerdp2-2-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le"
},
"product_reference": "libfreerdp2-2-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libfreerdp2-2-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x"
},
"product_reference": "libfreerdp2-2-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libfreerdp2-2-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64"
},
"product_reference": "libfreerdp2-2-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr2-2-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64"
},
"product_reference": "libwinpr2-2-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr2-2-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le"
},
"product_reference": "libwinpr2-2-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr2-2-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x"
},
"product_reference": "libwinpr2-2-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwinpr2-2-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64"
},
"product_reference": "libwinpr2-2-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "winpr2-devel-2.11.7-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64"
},
"product_reference": "winpr2-devel-2.11.7-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "winpr2-devel-2.11.7-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le"
},
"product_reference": "winpr2-devel-2.11.7-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "winpr2-devel-2.11.7-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x"
},
"product_reference": "winpr2-devel-2.11.7-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "winpr2-devel-2.11.7-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
},
"product_reference": "winpr2-devel-2.11.7-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-22855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-22855"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-22855",
"url": "https://www.suse.com/security/cve/CVE-2026-22855"
},
{
"category": "external",
"summary": "SUSE Bug 1256721 for CVE-2026-22855",
"url": "https://bugzilla.suse.com/1256721"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-22855"
},
{
"cve": "CVE-2026-22857",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-22857"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp-\u003eComplete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-22857",
"url": "https://www.suse.com/security/cve/CVE-2026-22857"
},
{
"category": "external",
"summary": "SUSE Bug 1256723 for CVE-2026-22857",
"url": "https://bugzilla.suse.com/1256723"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-22857"
},
{
"cve": "CVE-2026-23533",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23533"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23533",
"url": "https://www.suse.com/security/cve/CVE-2026-23533"
},
{
"category": "external",
"summary": "SUSE Bug 1256943 for CVE-2026-23533",
"url": "https://bugzilla.suse.com/1256943"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-23533"
},
{
"cve": "CVE-2026-23732",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23732"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23732",
"url": "https://www.suse.com/security/cve/CVE-2026-23732"
},
{
"category": "external",
"summary": "SUSE Bug 1256945 for CVE-2026-23732",
"url": "https://bugzilla.suse.com/1256945"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-23732"
},
{
"cve": "CVE-2026-23883",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23883"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23883",
"url": "https://www.suse.com/security/cve/CVE-2026-23883"
},
{
"category": "external",
"summary": "SUSE Bug 1256946 for CVE-2026-23883",
"url": "https://bugzilla.suse.com/1256946"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-23883"
},
{
"cve": "CVE-2026-23884",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23884"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi-\u003edrawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23884",
"url": "https://www.suse.com/security/cve/CVE-2026-23884"
},
{
"category": "external",
"summary": "SUSE Bug 1256947 for CVE-2026-23884",
"url": "https://bugzilla.suse.com/1256947"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-23884"
},
{
"cve": "CVE-2026-26271",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-26271"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachable over the network when a client processes icon data from an RDP server (or from a man-in-the-middle). Version 3.23.0 fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-26271",
"url": "https://www.suse.com/security/cve/CVE-2026-26271"
},
{
"category": "external",
"summary": "SUSE Bug 1258979 for CVE-2026-26271",
"url": "https://bugzilla.suse.com/1258979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-26271"
},
{
"cve": "CVE-2026-26955",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-26955"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd-\u003eleft`/`cmd-\u003etop` (and subcodec rectangle offsets) to reach image copy routines that write into `surface-\u003edata` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct\u0027s `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command - full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-26955",
"url": "https://www.suse.com/security/cve/CVE-2026-26955"
},
{
"category": "external",
"summary": "SUSE Bug 1258982 for CVE-2026-26955",
"url": "https://bugzilla.suse.com/1258982"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-26955"
},
{
"cve": "CVE-2026-26965",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-26965"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar-\u003epTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop \u2264 128x128), an adjacent `NSC_CONTEXT` struct\u0027s `decode` function pointer is overwritten with attacker-controlled pixel data - control-flow-relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc-\u003edecode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-26965",
"url": "https://www.suse.com/security/cve/CVE-2026-26965"
},
{
"category": "external",
"summary": "SUSE Bug 1258985 for CVE-2026-26965",
"url": "https://bugzilla.suse.com/1258985"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-26965"
},
{
"cve": "CVE-2026-31806",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31806"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31806",
"url": "https://www.suse.com/security/cve/CVE-2026-31806"
},
{
"category": "external",
"summary": "SUSE Bug 1259653 for CVE-2026-31806",
"url": "https://bugzilla.suse.com/1259653"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-31806"
},
{
"cve": "CVE-2026-31883",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31883"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u003e 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31883",
"url": "https://www.suse.com/security/cve/CVE-2026-31883"
},
{
"category": "external",
"summary": "SUSE Bug 1259679 for CVE-2026-31883",
"url": "https://bugzilla.suse.com/1259679"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-31883"
},
{
"cve": "CVE-2026-31885",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31885"
}
],
"notes": [
{
"category": "general",
"text": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31885",
"url": "https://www.suse.com/security/cve/CVE-2026-31885"
},
{
"category": "external",
"summary": "SUSE Bug 1259686 for CVE-2026-31885",
"url": "https://bugzilla.suse.com/1259686"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-devel-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-proxy-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:freerdp2-server-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libfreerdp2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:libwinpr2-2-2.11.7-6.1.x86_64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.aarch64",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.ppc64le",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.s390x",
"openSUSE Tumbleweed:winpr2-devel-2.11.7-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-29T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-31885"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…