https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:29:38.299166+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:2048 ALSA-2026:2048 — Important: freerdp security update 2026-10-03T17:29:38.397785+00:00

Affected: AlmaLinux:9: freerdp, AlmaLinux:9: freerdp-devel, AlmaLinux:9: freerdp-libs, AlmaLinux:9: libwinpr, AlmaLinux:9: libwinpr-devel

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-00662 bdu:2026-00662 2026-10-03T17:29:38.397865+00:00 bdu:2026-00662 https://cve.radiocsirt.org/vuln/euvd-2026-337475 EUVD-2026-337475 2026-10-03T17:29:38.397883+00:00 EUVD-2026-337475 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23884 fkie_cve-2026-23884 2026-10-03T17:29:38.397896+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/oesa-2026-1516 OESA-2026-1516 — freerdp security update 2026-10-03T17:29:38.397923+00:00

Affected: openEuler:24.03-LTS-SP1: freerdp

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp. Security Fix(es):

A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-22852)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when the `cbAttrLen` parameter does not match the actual NDR (Network Data Representation) buffer length. An attacker could potentially exploit this vulnerability to read sensitive information from process memory or cause the application to crash.(CVE-2026-22855)

A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-22856)

A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. The vulnerability exists in the irp_thread_func function.(CVE-2026-22857)

A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10107-1 openSUSE-SU-2026:10107-1 — freerdp-3.21.0-1.1 on GA media 2026-10-03T17:29:38.397996+00:00

freerdp-3.21.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:2714 RHSA-2026:2714 — Red Hat Security Advisory: freerdp security update 2026-10-03T17:29:38.398019+00:00

freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability

 https://cve.radiocsirt.org/vuln/suse-su-2026:0656-1 SUSE-SU-2026:0656-1 — Security update for freerdp 2026-10-03T17:29:38.398043+00:00

Security update for freerdp

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23884 UBUNTU-CVE-2026-23884 2026-10-03T17:29:38.398061+00:00

Affected: Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:25.10: freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0145 WID-SEC-W-2026-0145 — FreeRDP: Mehrere Schwachstellen ermöglichen DoS und Codeausführung 2026-10-03T17:29:38.398095+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen Denial-of-Service-Zustand zu verursachen oder möglicherweise beliebigen Code auszuführen.