{"schemaVersion":3,"id":"SUSE-SU-2026:3562-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for freerdp\n\nThis update for freerdp fixes the following issues:\n\n- CVE-2026-27951: 32-bit system denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).\n- CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).\n- CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).\n- CVE-2026-33982: heap buffer overread in `winpr_aligned_offset_recalloc()` can lead to undefined behavior\n  (bsc#1261222).\n- CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80\n  billion iteration loop (bsc#1261200).\n- CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).\n- CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).\n- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap out-of-bounds write due to persistent cache `bmpSize` desync (bsc#1261226).\n- CVE-2026-33995: double-free in `kerberos_AcceptSecurityContext()` and `kerberos_InitializeSecurityContextA()` can\n  lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).\n- CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of service or achieve\n  remote code execution (bsc#1266317).\n- CVE-2026-40254: off-by-one error in `contains_dotdot()` allows for drive channel path traversal (bsc#1262743).\n- CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends\n  a `CB_CLIP_CAPS` PDU with a too-small `capabilitySetLength` (bsc#1267008).\n- CVE-2026-44421: improper validation in `gdi_CacheToSurface` can lead to a heap buffer overwrite client when an RDP\n  server sends crafted RDPGFX PDUs (bsc#1267009).\n- CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR\n  authentication-redirection path (bsc#1267010).\n- CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write\n  (bsc#1267011).\n- CVE-2026-56297: improper synchronization of `channel_callback` access can lead to use-after-free in\n  `dvcman_channel_close` and `dvcman_call_on_receive` triggered by a malicious RDP server (bsc#1271071).\n- CVE-2026-57156: integer overflow in `update_read_delta_points` allows malicious RDP peers to cause a heap buffer\n  overflow (bsc#1271303).\n- CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM `DeviceName` and `VirtualChannelName`\n  fields (bsc#1271304).\n- CVE-2026-57158: incomplete fix for CVE-2026-23530 in `planar_decompress_plane_rle_only` allows a malicious RDP server\n  to trigger a one byte buffer overflow via a truncated `RDPGFX_CMDID_WIRETOSURFACE_1` planar payload (bsc#1271305).","dates":{"published":"2026-08-10T18:16:39.000Z","modified":"2026-08-12T10:45:04.866Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"freerdp&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"freerdp","label":"freerdp&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/freerdp&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 3.10.3-150700.3.17.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.3-150700.3.17.1","eol":null,"hubHref":null},{"vendor":"suse","product":"freerdp&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","name":"freerdp","label":"freerdp&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/freerdp&distro=SUSE Linux Enterprise Workstation Extension 15 SP7","purlType":"rpm","versions":[{"text":"< 3.10.3-150700.3.17.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.3-150700.3.17.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263562-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20263562-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1258939","label":"bugzilla.suse.com/1258939","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261196","label":"bugzilla.suse.com/1261196","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261198","label":"bugzilla.suse.com/1261198","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261200","label":"bugzilla.suse.com/1261200","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261211","label":"bugzilla.suse.com/1261211","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261217","label":"bugzilla.suse.com/1261217","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261222","label":"bugzilla.suse.com/1261222","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261223","label":"bugzilla.suse.com/1261223","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261226","label":"bugzilla.suse.com/1261226","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1261227","label":"bugzilla.suse.com/1261227","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262743","label":"bugzilla.suse.com/1262743","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266317","label":"bugzilla.suse.com/1266317","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267008","label":"bugzilla.suse.com/1267008","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267009","label":"bugzilla.suse.com/1267009","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267010","label":"bugzilla.suse.com/1267010","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267011","label":"bugzilla.suse.com/1267011","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271071","label":"bugzilla.suse.com/1271071","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271303","label":"bugzilla.suse.com/1271303","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271304","label":"bugzilla.suse.com/1271304","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271305","label":"bugzilla.suse.com/1271305","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27951","label":"www.suse.com/security/cve/CVE-2026-27951","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33952","label":"www.suse.com/security/cve/CVE-2026-33952","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33977","label":"www.suse.com/security/cve/CVE-2026-33977","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33982","label":"www.suse.com/security/cve/CVE-2026-33982","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33983","label":"www.suse.com/security/cve/CVE-2026-33983","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33984","label":"www.suse.com/security/cve/CVE-2026-33984","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33985","label":"www.suse.com/security/cve/CVE-2026-33985","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33986","label":"www.suse.com/security/cve/CVE-2026-33986","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33987","label":"www.suse.com/security/cve/CVE-2026-33987","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33995","label":"www.suse.com/security/cve/CVE-2026-33995","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40033","label":"www.suse.com/security/cve/CVE-2026-40033","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40254","label":"www.suse.com/security/cve/CVE-2026-40254","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44420","label":"www.suse.com/security/cve/CVE-2026-44420","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44421","label":"www.suse.com/security/cve/CVE-2026-44421","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44422","label":"www.suse.com/security/cve/CVE-2026-44422","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45700","label":"www.suse.com/security/cve/CVE-2026-45700","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56297","label":"www.suse.com/security/cve/CVE-2026-56297","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57156","label":"www.suse.com/security/cve/CVE-2026-57156","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57157","label":"www.suse.com/security/cve/CVE-2026-57157","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57158","label":"www.suse.com/security/cve/CVE-2026-57158","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-27951","CVE-2026-33952","CVE-2026-33977","CVE-2026-33982","CVE-2026-33983","CVE-2026-33984","CVE-2026-33985","CVE-2026-33986","CVE-2026-33987","CVE-2026-33995","CVE-2026-40033","CVE-2026-40254","CVE-2026-44420","CVE-2026-44421","CVE-2026-44422","CVE-2026-45700","CVE-2026-56297","CVE-2026-57156","CVE-2026-57157","CVE-2026-57158"],"downstream":[],"duplicates":[],"related":["CVE-2026-27951","CVE-2026-33952","CVE-2026-33977","CVE-2026-33982","CVE-2026-33983","CVE-2026-33984","CVE-2026-33985","CVE-2026-33986","CVE-2026-33987","CVE-2026-33995","CVE-2026-40033","CVE-2026-40254","CVE-2026-44420","CVE-2026-44421","CVE-2026-44422","CVE-2026-45700","CVE-2026-56297","CVE-2026-57156","CVE-2026-57157","CVE-2026-57158"]},"timeline":[{"kind":"published","date":"2026-08-10T18:16:39.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-12T10:45:04.866Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:14:21.719Z","stale":false,"partial":false}}