Vulnerability-Lookup

RHSA-2026:76747

Vulnerability from csaf_opensuse - Published: 2026-10-06 00:00 - Updated: 2026-10-08 17:56

Summary

security update for freerdp

Severity

Important

Notes

Title of the patch: security update for freerdp

Description of the patch: This security update provides a functional equivalent of RHSA-2026:76747. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:76747.

Patchnames: RHSA-2026:76747

CVE-2026-91953

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected products

Recommended 9 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-91954

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2026-91953

Threats

Impact moderate

CVE-2026-91956

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2026-91953

Threats

Impact moderate

CVE-2026-91959

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2026-91953

Threats

Impact moderate

CVE-2026-91963

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 9 products, the same list as for CVE-2026-91953

Threats

Impact moderate

CVE-2026-91964

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2026-91953

Threats

Impact important

References

22 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-91953/	self
https://www.suse.com/security/cve/CVE-2026-91954/	self
https://www.suse.com/security/cve/CVE-2026-91956/	self
https://www.suse.com/security/cve/CVE-2026-91959/	self
https://www.suse.com/security/cve/CVE-2026-91963/	self
https://www.suse.com/security/cve/CVE-2026-91964/	self
https://www.suse.com/security/cve/CVE-2026-91953	external
https://bugzilla.suse.com/1280887	external
https://www.suse.com/security/cve/CVE-2026-91954	external
https://bugzilla.suse.com/1280888	external
https://www.suse.com/security/cve/CVE-2026-91956	external
https://bugzilla.suse.com/1280891	external
https://www.suse.com/security/cve/CVE-2026-91959	external
https://bugzilla.suse.com/1280894	external
https://www.suse.com/security/cve/CVE-2026-91963	external
https://bugzilla.suse.com/1280961	external
https://www.suse.com/security/cve/CVE-2026-91964	external
https://bugzilla.suse.com/1280959	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for freerdp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:76747.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:76747.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:76747",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_76747.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:76747",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008107.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:76747",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008107.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91953 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91953/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91954 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91954/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91956 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91956/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91959 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91959/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91963 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91963/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-91964 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-91964/"
      }
    ],
    "title": "security update for freerdp",
    "tracking": {
      "current_release_date": "2026-10-08T17:56:58Z",
      "generator": {
        "date": "2026-10-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:76747",
      "initial_release_date": "2026-10-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-08T17:56:58Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.11.7-14.el8_10.i686",
                "product": {
                  "name": "freerdp-devel-2:2.11.7-14.el8_10.i686",
                  "product_id": "freerdp-devel-2:2.11.7-14.el8_10.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-devel@2.11.7-14.el8_10?arch=i686\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-14.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.11.7-14.el8_10.i686",
                "product": {
                  "name": "freerdp-libs-2:2.11.7-14.el8_10.i686",
                  "product_id": "freerdp-libs-2:2.11.7-14.el8_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/freerdp-libs@2.11.7-14.el8_10?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.11.7-14.el8_10.i686",
                "product": {
                  "name": "libwinpr-2:2.11.7-14.el8_10.i686",
                  "product_id": "libwinpr-2:2.11.7-14.el8_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr@2.11.7-14.el8_10?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.11.7-14.el8_10.i686",
                "product": {
                  "name": "libwinpr-devel-2:2.11.7-14.el8_10.i686",
                  "product_id": "libwinpr-devel-2:2.11.7-14.el8_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr-devel@2.11.7-14.el8_10?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.11.7-14.el8_10.x86_64",
                "product": {
                  "name": "freerdp-2:2.11.7-14.el8_10.x86_64",
                  "product_id": "freerdp-2:2.11.7-14.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp@2.11.7-14.el8_10?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-14.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.11.7-14.el8_10.x86_64",
                "product": {
                  "name": "freerdp-devel-2:2.11.7-14.el8_10.x86_64",
                  "product_id": "freerdp-devel-2:2.11.7-14.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:freerdp:freerdp:2.11.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/freerdp-devel@2.11.7-14.el8_10?arch=x86_64\u0026epoch=2\u0026upstream=freerdp-2:2.11.7-14.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.11.7-14.el8_10.x86_64",
                "product": {
                  "name": "freerdp-libs-2:2.11.7-14.el8_10.x86_64",
                  "product_id": "freerdp-libs-2:2.11.7-14.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/freerdp-libs@2.11.7-14.el8_10?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.11.7-14.el8_10.x86_64",
                "product": {
                  "name": "libwinpr-2:2.11.7-14.el8_10.x86_64",
                  "product_id": "libwinpr-2:2.11.7-14.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr@2.11.7-14.el8_10?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.11.7-14.el8_10.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:2.11.7-14.el8_10.x86_64",
                  "product_id": "libwinpr-devel-2:2.11.7-14.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libwinpr-devel@2.11.7-14.el8_10?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.11.7-14.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64"
        },
        "product_reference": "freerdp-2:2.11.7-14.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.11.7-14.el8_10.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686"
        },
        "product_reference": "freerdp-devel-2:2.11.7-14.el8_10.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.11.7-14.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64"
        },
        "product_reference": "freerdp-devel-2:2.11.7-14.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.11.7-14.el8_10.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686"
        },
        "product_reference": "freerdp-libs-2:2.11.7-14.el8_10.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.11.7-14.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.11.7-14.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.11.7-14.el8_10.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686"
        },
        "product_reference": "libwinpr-2:2.11.7-14.el8_10.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.11.7-14.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64"
        },
        "product_reference": "libwinpr-2:2.11.7-14.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.11.7-14.el8_10.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686"
        },
        "product_reference": "libwinpr-devel-2:2.11.7-14.el8_10.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.11.7-14.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.11.7-14.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-91953",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91953"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91953",
          "url": "https://www.suse.com/security/cve/CVE-2026-91953"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280887 for CVE-2026-91953",
          "url": "https://bugzilla.suse.com/1280887"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-91953"
    },
    {
      "cve": "CVE-2026-91954",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91954"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91954",
          "url": "https://www.suse.com/security/cve/CVE-2026-91954"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280888 for CVE-2026-91954",
          "url": "https://bugzilla.suse.com/1280888"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-91954"
    },
    {
      "cve": "CVE-2026-91956",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91956"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel\u0027s func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91956",
          "url": "https://www.suse.com/security/cve/CVE-2026-91956"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280891 for CVE-2026-91956",
          "url": "https://bugzilla.suse.com/1280891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-91956"
    },
    {
      "cve": "CVE-2026-91959",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91959"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91959",
          "url": "https://www.suse.com/security/cve/CVE-2026-91959"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280894 for CVE-2026-91959",
          "url": "https://bugzilla.suse.com/1280894"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-91959"
    },
    {
      "cve": "CVE-2026-91963",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91963"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91963",
          "url": "https://www.suse.com/security/cve/CVE-2026-91963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280961 for CVE-2026-91963",
          "url": "https://bugzilla.suse.com/1280961"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-91963"
    },
    {
      "cve": "CVE-2026-91964",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-91964"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
          "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-91964",
          "url": "https://www.suse.com/security/cve/CVE-2026-91964"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280959 for CVE-2026-91964",
          "url": "https://bugzilla.suse.com/1280959"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:freerdp-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-devel-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:freerdp-libs-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-2:2.11.7-14.el8_10.x86_64",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.i686",
            "SUSE Liberty Linux 8:libwinpr-devel-2:2.11.7-14.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-91964"
    }
  ]
}

CVE-2026-91953 (GCVE-0-2026-91953)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-15 16:01

Title

FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

Summary

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:01 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91953",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:01:12.250084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:01:36.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:09.893Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r9pv-ffph-6gg6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info"
        }
      ],
      "title": "FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91953",
    "datePublished": "2026-09-15T15:18:09.893Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-15T16:01:36.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91954 (GCVE-0-2026-91954)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-17 19:28

Title

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

Summary

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 19:15 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

dutchypoo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T19:15:29.879498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T19:28:25.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dutchypoo"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:10.550Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ffjr-p229-hpch)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec"
        }
      ],
      "title": "FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91954",
    "datePublished": "2026-09-15T15:18:10.550Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-17T19:28:25.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91956 (GCVE-0-2026-91956)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-18 17:23

Title

FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

Summary

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 17:15 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

Baixingyuu KeenSecurityLab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:15:30.626368Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:05.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Baixingyuu"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "KeenSecurityLab"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel\u0027s func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:11.941Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hg4r-vv53-vwf8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc"
        }
      ],
      "title": "FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91956",
    "datePublished": "2026-09-15T15:18:11.941Z",
    "dateReserved": "2026-09-15T11:07:34.398Z",
    "dateUpdated": "2026-09-18T17:23:05.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91959 (GCVE-0-2026-91959)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-20 00:35

Title

FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

Summary

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-20 00:29 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-01 00:00

Credits

Nambers

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91959",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-20T00:29:03.414714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-20T00:35:29.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nambers"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:13.970Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-pj8w-fh79-f438)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway"
        }
      ],
      "title": "FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91959",
    "datePublished": "2026-09-15T15:18:13.970Z",
    "dateReserved": "2026-09-15T11:08:44.669Z",
    "dateUpdated": "2026-09-20T00:35:29.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91963 (GCVE-0-2026-91963)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-15 15:58

Title

FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

Summary

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 15:56 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.0.0 (semver) Affected: 3.0.0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)

Date Public

2026-09-01 00:00

Credits

iarce-qb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91963",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:56:52.431518Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:58:06.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iarce-qb"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:16.675Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hw7p-5h2r-83gq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc"
        }
      ],
      "title": "FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91963",
    "datePublished": "2026-09-15T15:18:16.675Z",
    "dateReserved": "2026-09-15T11:08:44.670Z",
    "dateUpdated": "2026-09-15T15:58:06.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91964 (GCVE-0-2026-91964)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-16 15:51

Title

FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

Summary

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 03:56 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.0.0 (semver) Affected: 3.0.0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)
FreeRDP	FreeRDP	Affected: 0 , < 3.31.0 (semver) Unaffected: 3.31.0 (semver)

Date Public

2026-09-01 00:00

Credits

iarce-qb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T03:56:32.717523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:26.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.31.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iarce-qb"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:18:17.388Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2vf2-grvj-6g8x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-heap-buffer-overflow-via-routingtoken"
        }
      ],
      "title": "FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91964",
    "datePublished": "2026-09-15T15:18:17.388Z",
    "dateReserved": "2026-09-15T11:08:44.670Z",
    "dateUpdated": "2026-09-16T15:51:26.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:76747

CVE-2026-91953 (GCVE-0-2026-91953)

CVE-2026-91954 (GCVE-0-2026-91954)

CVE-2026-91956 (GCVE-0-2026-91956)

CVE-2026-91959 (GCVE-0-2026-91959)

CVE-2026-91963 (GCVE-0-2026-91963)

CVE-2026-91964 (GCVE-0-2026-91964)

Tags

Sightings

Nomenclature

Related by attack behaviour