RHSA-2026:54486

Vulnerability from csaf_opensuse - Published: 2026-08-13 00:00 - Updated: 2026-09-16 18:43
Summary
security update for freerdp
Severity
Important
Notes
Title of the patch: security update for freerdp
Description of the patch: This security update provides a functional equivalent of RHSA-2026:54486. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:54486.
Patchnames: RHSA-2026:54486
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-64620
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-64621
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Affected products
Recommended 6 products, the same list as for CVE-2026-64620
Threats
Impact important
CVE-2026-64624
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 6 products, the same list as for CVE-2026-64620
Threats
Impact important
CVE-2026-67289
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 6 products, the same list as for CVE-2026-64620
Threats
Impact important
CVE-2026-67299
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
Recommended 6 products, the same list as for CVE-2026-64620
Threats
Impact moderate
CVE-2026-68580
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected products
Recommended 6 products, the same list as for CVE-2026-64620
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for freerdp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:54486.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:54486.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:54486",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_54486.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:54486",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007439.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:54486",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007439.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64620 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64620/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64621 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64621/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64624 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64624/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-67289 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-67289/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-67299 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-67299/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68580 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68580/"
      }
    ],
    "title": "security update for freerdp",
    "tracking": {
      "current_release_date": "2026-09-16T18:43:46Z",
      "generator": {
        "date": "2026-08-13T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:54486",
      "initial_release_date": "2026-08-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-13T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:01:54Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:43:46Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "freerdp-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "freerdp-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:3.10.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:3.10.3-12.el10_2.8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:3.10.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-devel@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:3.10.3-12.el10_2.8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/freerdp-libs@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2:3.10.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-server@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:3.10.3-12.el10_2.8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "libwinpr-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "libwinpr-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64",
                  "product_id": "libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr-devel@3.10.3-12.el10_2.8?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 10",
                "product": {
                  "name": "SUSE Liberty Linux 10",
                  "product_id": "SUSE Liberty Linux 10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "freerdp-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-server-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "libwinpr-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        },
        "product_reference": "libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-64620",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64620"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.28.0 (affected \u003c=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller\u0027s output buffer via BN_bn2bin() and only afterward checks output_length \u003e out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64620",
          "url": "https://www.suse.com/security/cve/CVE-2026-64620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273122 for CVE-2026-64620",
          "url": "https://bugzilla.suse.com/1273122"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64620"
    },
    {
      "cve": "CVE-2026-64621",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64621"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings-\u003eMonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64621",
          "url": "https://www.suse.com/security/cve/CVE-2026-64621"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273123 for CVE-2026-64621",
          "url": "https://bugzilla.suse.com/1273123"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64621"
    },
    {
      "cve": "CVE-2026-64624",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64624"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64624",
          "url": "https://www.suse.com/security/cve/CVE-2026-64624"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273124 for CVE-2026-64624",
          "url": "https://bugzilla.suse.com/1273124"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64624"
    },
    {
      "cve": "CVE-2026-67289",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-67289"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.29.0 (affected versions \u003c= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client\u0027s ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-67289",
          "url": "https://www.suse.com/security/cve/CVE-2026-67289"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273248 for CVE-2026-67289",
          "url": "https://bugzilla.suse.com/1273248"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-67289"
    },
    {
      "cve": "CVE-2026-67299",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-67299"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam-\u003eiconInfo with the parser-owned windowIcon-\u003eiconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-67299",
          "url": "https://www.suse.com/security/cve/CVE-2026-67299"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273409 for CVE-2026-67299",
          "url": "https://bugzilla.suse.com/1273409"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-67299"
    },
    {
      "cve": "CVE-2026-68580",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68580"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68580",
          "url": "https://www.suse.com/security/cve/CVE-2026-68580"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273410 for CVE-2026-68580",
          "url": "https://bugzilla.suse.com/1273410"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:freerdp-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-devel-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-libs-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:freerdp-server-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-2:3.10.3-12.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-68580"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.