The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19033 advisory.

    - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
    - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)       Resolves: RHEL-162947, RHEL-162963

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-397:10 advisory.

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)
      * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)
      * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)
      * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)
      * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)
      * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)
      * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)
      * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)
      * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)
      * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)
      * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)
      * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)
      * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6958 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:6799 advisory.

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

    * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

    * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

    * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

    * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

    * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

    * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

    * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

    * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

    * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

    * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

    * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

    * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:6799 advisory.

    * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)
      * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)
      * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)
      * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)
      * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)
      * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)
      * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)
      * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)
      * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)
      * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)
      * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)
      * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)
      * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)
      * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages     (CVE-2026-31806)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010669 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches     channel_callback in a local variable and later uses it without synchronization; a concurrent channel close     can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is     fixed in 3.22.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches     channel_callback in a local variable and later uses it without synchronization; a concurrent channel close     can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is     fixed in 3.22.0. (CVE-2026-24683)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0266 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-22852:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server     can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format     lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and     writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability     is fixed in 3.20.1.

    CVE-2026-22854:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow     occurs in drive read when a server-controlled read length is used to read file data into an IRP output     stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This     vulnerability is fixed in 3.20.1.

    CVE-2026-22856:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial     channel IRP thread tracking allows a heap useafterfree when one thread removes an entry from     serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.

    CVE-2026-23732:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph     parsing trusts cbData/remaining length and never validates against the minimum size implied by cx/cy. A     malicious server can trigger a clientside global buffer overflow, causing a crash (DoS). Version 3.21.0     contains a patch for the issue.

    CVE-2026-23948:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer     dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP     proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability     is fixed in 3.22.0.

    CVE-2026-24491:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send     client notifications after the control channel is closed, dereferencing a freed callback and triggering a     use after free. This vulnerability is fixed in 3.22.0.

    CVE-2026-24675:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can     free the device's MS config on error but later code still dereferences it, leading to a use after free in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24676:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format     renegotiation frees the active format list while the capture thread continues using audin->format, leading     to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.

    CVE-2026-24679:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses     server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in     libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

    CVE-2026-24681:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk     transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after     free in urb_write_completion. This vulnerability is fixed in 3.22.0.

    CVE-2026-24683:
    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches     channel_callback in a local variable and later uses it without synchronization; a concurrent channel close     can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is     fixed in 3.22.0.

    CVE-2026-24684:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async     playback thread can process queued PDUs after the channel is closed and internal state is freed, leading     to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

    CVE-2026-31806:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits()     function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using     NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the     actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that     exceed the expected surface size. Because these values are used during bitmap decoding and memory     operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can     also control the associated pixel data transmitted by the server, the overflow may be exploitable to     overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-6918 advisory.

    [2:2.11.7-6]
    - Fix use of nsc_process_message       Resolves: RHEL-155984

    [2:2.11.7-5]
    - Backport several CVE fixes       Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980       Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996       Resolves: RHEL-149007, RHEL-149056, RHEL-155984

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8042-1 advisory.

    It was discovered that FreeRDP incorrectly handled memory under certain circumstances, which could lead to     a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-23948)

    It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause     a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24491)

    It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause     a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. (CVE-2026-24675, CVE-2026-24679, CVE-2026-24682)

    It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2026-24676,     CVE-2026-24681)

    It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause     a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-24677)

    It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker     could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected     Ubuntu 25.10. (CVE-2026-24678)

    It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker     could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected     FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24680)

    It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker     could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24683, CVE-2026-24684)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1454 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer     dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP     proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability     is fixed in 3.22.0. (CVE-2026-23948)

    Client side issue with FreeRDP (CVE-2026-24491)

    Client side issue with FreeRDP (CVE-2026-24675)

    Client side issue with FreeRDP (CVE-2026-24676)

    Client side issue with FreeRDP (CVE-2026-24677)

    Client side issue with FreeRDP (CVE-2026-24678)

    Client side issue with FreeRDP (CVE-2026-24679)

    Client side issue with FreeRDP (CVE-2026-24680)

    Client side issue with FreeRDP (CVE-2026-24681)

    Client side issue with FreeRDP (CVE-2026-24682)

    Client side issue with FreeRDP (CVE-2026-24683)

    Client side issue with FreeRDP (CVE-2026-24684)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327011	Oracle Linux 10 : freerdp (ELSA-2026-19033)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	critical
304870	MiracleLinux 9 : freerdp-2.11.7-1.el9_7.5 (AXSA:2026-397:10)	Nessus	Miracle Linux Local Security Checks	2026/4/4	2026/4/4	critical
305272	RHEL 9 : freerdp (RHSA-2026:6958)	Nessus	Red Hat Local Security Checks	2026/4/8	2026/4/8	critical
305761	RockyLinux 10 : freerdp (RLSA-2026:6799)	Nessus	Rocky Linux Local Security Checks	2026/4/9	2026/4/9	critical
305950	AlmaLinux 10 : freerdp (ALSA-2026:6799)	Nessus	Alma Linux Local Security Checks	2026/4/10	2026/4/10	critical
307369	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-010669)	Nessus	Unity Linux Local Security Checks	2026/4/17	2026/4/17	high
297182	Linux Distros Unpatched Vulnerability : CVE-2026-24683	Nessus	Misc.	2026/1/29	2026/9/2	high
310961	TencentOS Server 3: freerdp (TSSA-2026:0266)	Nessus	Tencent Local Security Checks	2026/4/29	2026/4/29	critical
305304	Oracle Linux 8 : freerdp (ELSA-2026-6918)	Nessus	Oracle Linux Local Security Checks	2026/4/8	2026/5/7	critical
299346	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : FreeRDP vulnerabilities (USN-8042-1)	Nessus	Ubuntu Local Security Checks	2026/2/18	2026/2/18	high
301354	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1454)	Nessus	Amazon Linux Local Security Checks	2026/3/6	2026/4/30	high

检测

插件搜索

critical

critical

critical

critical

critical

high

high

critical

critical

high

high