Vulnerability-Lookup

RHSA-2026:66282

Vulnerability from csaf_redhat - Published: 2026-09-10 02:05 - Updated: 2026-09-10 03:34

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Notes

Topic: An update for freerdp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller `alloc_hint` value instead of the actual `StubLength` for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-67288

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-67291

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-67301

A flaw was found in FreeRDP. When the `async-update` feature is enabled, a malicious or compromised Remote Desktop Protocol (RDP) server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to crash, resulting in a Denial of Service.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 40 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

35 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:66282	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509994	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510001	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510010	external
https://bugzilla.redhat.com/show_bug.cgi?id=2519824	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-55194	self
https://bugzilla.redhat.com/show_bug.cgi?id=2519824	external
https://www.cve.org/CVERecord?id=CVE-2026-55194	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55194	external
https://github.com/FreeRDP/FreeRDP/commit/9f2da52…	external
https://github.com/FreeRDP/FreeRDP/pull/12873	external
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-67288	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510001	external
https://www.cve.org/CVERecord?id=CVE-2026-67288	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67288	external
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	external
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-67291	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510010	external
https://www.cve.org/CVERecord?id=CVE-2026-67291	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67291	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-67301	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509994	external
https://www.cve.org/CVERecord?id=CVE-2026-67301	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67301	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for freerdp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n\n* FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n\n* FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n\n* FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66282",
        "url": "https://access.redhat.com/errata/RHSA-2026:66282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2509994",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509994"
      },
      {
        "category": "external",
        "summary": "2510001",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510001"
      },
      {
        "category": "external",
        "summary": "2510010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510010"
      },
      {
        "category": "external",
        "summary": "2519824",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519824"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66282.json"
      }
    ],
    "title": "Red Hat Security Advisory: freerdp security update",
    "tracking": {
      "current_release_date": "2026-09-10T03:34:54+00:00",
      "generator": {
        "date": "2026-09-10T03:34:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:66282",
      "initial_release_date": "2026-09-10T02:05:39+00:00",
      "revision_history": [
        {
          "date": "2026-09-10T02:05:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-10T02:05:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T03:34:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.TUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.11.src",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.11.src",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.11.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.11?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.11?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "freerdp-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "freerdp-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.11?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "freerdp-libs-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "libwinpr-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "libwinpr-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-12.el8_8.11?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.11.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.11.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.11.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.11.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55194",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-08-19T18:01:17.676363+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller `alloc_hint` value instead of the actual `StubLength` for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow flaw was found in FreeRDP\u0027s TS Gateway RPC client (`libfreerdp/core/gateway/rpc_client.c`). During response fragment reassembly in `rpc_client_recv_fragment`, stream allocation relies on the server-provided `alloc_hint` rather than the actual `StubLength`. A malicious TS Gateway can send a `PTYPE_RESPONSE` packet with a small `alloc_hint` and a larger payload, causing `Stream_Write` to overwrite memory beyond the fixed 4096-byte buffer (`pdu-\u003es`). This can result in client crashes or potential arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55194",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55194",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55194"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx"
        }
      ],
      "release_date": "2026-08-19T17:50:30.158000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T02:05:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66282"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, avoid connecting through untrusted TS Gateways (RD Gateways) or disable gateway parameters (such as omitting `/g:` in `xfreerdp`) to force direct RDP connections and bypass RPC response parsing.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response"
    },
    {
      "cve": "CVE-2026-67288",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-01T13:02:16.978525+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510001"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate denial of service flaw affects FreeRDP in Red Hat products. When smartcard emulation is enabled, a remote attacker can exploit this vulnerability by sending malformed smartcard cache requests, leading to a null pointer dereference and subsequent termination of the FreeRDP client process. This can disrupt active remote desktop sessions for affected users.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510001",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510001"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67288"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
        }
      ],
      "release_date": "2026-08-01T12:22:18.305000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T02:05:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66282"
        },
        {
          "category": "workaround",
          "details": "If smartcard redirection/emulation is unused, do not enable it (omit /smartcard and /smartcard-logon, or start with /smartcard:off). Only connect FreeRDP clients to trusted RDP endpoints",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests"
    },
    {
      "cve": "CVE-2026-67291",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-01T13:02:45.885457+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate heap out-of-bounds read in FreeRDP affects Red Hat products by allowing an untrusted RDP server to remotely crash a connecting client without authentication, resulting in a loss of application availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67291",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67291",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67291"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add"
        }
      ],
      "release_date": "2026-08-01T12:22:18.322000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T02:05:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66282"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid connecting FreeRDP clients to untrusted or potentially malicious RDP servers. If such connections are required, run the client on a dedicated, isolated system so a client crash is contained and does not impact other workloads.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read"
    },
    {
      "cve": "CVE-2026-67301",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-01T13:01:53.731118+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509994"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FreeRDP. When the `async-update` feature is enabled, a malicious or compromised Remote Desktop Protocol (RDP) server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to crash, resulting in a Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate out-of-bounds read flaw in FreeRDP allows a malicious server to cause memory disclosure or crash the client, but only when the non-default async-update feature is explicitly enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
          "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
          "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
          "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509994",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509994"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67301",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67301",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67301"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f",
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy",
          "url": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy"
        }
      ],
      "release_date": "2026-08-01T12:22:16.955000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T02:05:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66282"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the `async-update` feature when using FreeRDP clients. This feature is not enabled by default. If `xfreerdp` is used, ensure the `/async-update` command-line option is not specified. Disabling this feature may impact performance in certain RDP sessions where asynchronous updates are beneficial.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.E4S:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.ppc64le",
            "AppStream-8.8.0.Z.E4S:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.src",
            "AppStream-8.8.0.Z.TUS:freerdp-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-debugsource-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:freerdp-libs-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-debuginfo-2:2.2.0-12.el8_8.11.x86_64",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.i686",
            "AppStream-8.8.0.Z.TUS:libwinpr-devel-2:2.2.0-12.el8_8.11.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders"
    }
  ]
}

CVE-2026-55194 (GCVE-0-2026-55194)

Vulnerability from cvelistv5 – Published: 2026-08-19 17:50 – Updated: 2026-08-27 16:25

Title

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 03:55 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/pull/12873	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/commit/9f2da52…	x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 3.27.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55194",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T03:55:49.884406Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T16:25:00.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu-\u003es buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:50:30.158Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/pull/12873",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/pull/12873"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a"
        },
        {
          "name": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9gxm-3mf5-f5cx",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55194",
    "datePublished": "2026-08-19T17:50:30.158Z",
    "dateReserved": "2026-06-16T15:20:43.087Z",
    "dateUpdated": "2026-08-27T16:25:00.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67288 (GCVE-0-2026-67288)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 19:49

Title

FreeRDP before 3.29.0 Denial of Service via smartcard cache

Summary

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:47 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	patch
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory
https://github.com/FreeRDP/FreeRDP/security/advis…	exploit

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67288",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:47:44.966327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:49:39.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.305Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
        }
      ],
      "title": "FreeRDP before 3.29.0 Denial of Service via smartcard cache",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67288",
    "datePublished": "2026-08-01T12:22:18.305Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T19:49:39.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67291 (GCVE-0-2026-67291)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 14:56

Title

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

Summary

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 14:56 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67291",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:56:02.777922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T14:56:19.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 (affected versions \u003c= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.322Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hgj8-g595-wfc6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add"
        }
      ],
      "title": "FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67291",
    "datePublished": "2026-08-01T12:22:18.322Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T14:56:19.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67301 (GCVE-0-2026-67301)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 18:23

Title

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

Summary

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 18:23 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67301",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T18:23:42.208706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T18:23:49.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC-\u003epoints / polygonCB-\u003epoints, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:16.955Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vxp3-7g6q-rq2w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy"
        }
      ],
      "title": "FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67301",
    "datePublished": "2026-08-01T12:22:16.955Z",
    "dateReserved": "2026-07-29T13:04:41.947Z",
    "dateUpdated": "2026-08-03T18:23:49.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:66282

CVE-2026-55194 (GCVE-0-2026-55194)

CVE-2026-67288 (GCVE-0-2026-67288)

CVE-2026-67291 (GCVE-0-2026-67291)

CVE-2026-67301 (GCVE-0-2026-67301)

Tags

Sightings

Nomenclature