The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19142 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    * FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read     (CVE-2026-33982)

    * FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution     (CVE-2026-33987)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16019 advisory.

    - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952)       Resolves: RHEL-159850
    - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
    - Fix growth of preallocated buffers (CVE-2026-27951)
    - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
    - Add DSP format checks (CVE-2026-31884)
    - Fix DSP array bounds checks (CVE-2026-31883)
    - Fix DSP array bounds checks (CVE-2026-31885)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16485 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16482 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:16014 advisory.

    * freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)
      * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
      * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
      * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
      * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index     bounds checks (CVE-2026-31885)
      * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)
      * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
      * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)
      * FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read     (CVE-2026-33982)
      * FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution     (CVE-2026-33987)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16482 advisory.

    - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
    - Fix growth of preallocated buffers (CVE-2026-27951)
    - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
    - Add DSP format checks (CVE-2026-31884)
    - Fix DSP array bounds checks (CVE-2026-31883)
    - Fix DSP array bounds checks (CVE-2026-31885)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16865 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:16482 advisory.

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
      * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
      * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity     (CVE-2026-27951)
      * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
      * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index     bounds checks (CVE-2026-31885)
      * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)
      * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
      * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1520 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap     buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing     horizontal bounds validation of H.264 metablock regionRects coordinates.  In yuv.c, the clamp() function     (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against     the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using     rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface     buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry     where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream     decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint =     pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the     allocated heap region. This vulnerability is fixed in 3.24.0. (CVE-2026-29774)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0. (CVE-2026-29775)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in     update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
    (CVE-2026-29776)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0. (CVE-2026-31883)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0. (CVE-2026-31884)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0. (CVE-2026-31885)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which     points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL,     this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
    (CVE-2026-31897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19142 advisory.

    - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421,       CVE-2026-44422, CVE-2026-45700)       Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093
    - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952)       Resolves: RHEL-159848
    - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
    - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997)
    - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
    - Add DSP format checks (CVE-2026-31884)
    - Fix DSP array bounds checks (CVE-2026-31883)
    - Fix DSP array bounds checks (CVE-2026-31885)
    - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987)
    - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16483 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

    * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

    * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

    * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

    * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds     checks (CVE-2026-31885)

    * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

    * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

    * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0116 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-25952:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0,     `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in     `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the     main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread     is still using the pointer. Version 3.23.0 fixes the issue.

    CVE-2026-26986:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0,     `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because     `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the     entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect.
    Version 3.23.0 fixes the vulnerability.

    CVE-2026-27951:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function     `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server     implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the     available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are     available.

    CVE-2026-29775:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0.

    CVE-2026-31883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0.

    CVE-2026-31884:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0.

    CVE-2026-31885:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0.

    CVE-2026-33985:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from     adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue     has been patched in version 3.24.2.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0388 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-25952:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0,     xf_SetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xf_rail_get_window in     xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table, and the main     thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is     still using the pointer. Version 3.23.0 fixes the issue.

    CVE-2026-26986:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, rail_window_free     dereferences a freed xfAppWindow pointer during HashTable_Free cleanup because xf_rail_window_common calls     free(appWindow) on title allocation failure without first removing the entry from the railWindows hash     table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the     vulnerability.

    CVE-2026-27951:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function     Stream_EnsureCapacity can create an endless blocking loop. This may affect all client and server     implementations using FreeRDP. For practical exploitation this will only work on 32bit systems where the     available physical memory is >= SIZE_MAX. Version 3.23.0 contains a patch. No known workarounds are     available.

    CVE-2026-29775:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0.

    CVE-2026-31883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0.

    CVE-2026-31884:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0.

    CVE-2026-31885:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0.

    CVE-2026-33985:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from     adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue     has been patched in version 3.24.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c0deda1e7 advisory.

    Automatic update for freerdp2-2.11.7-16.fc46.

    ##### **Changelog**

    ```
    * Mon Aug 31 2026 Ondrej Holy <oholy@redhat.com> - 2.11.7-16
    - Backport several CVE fixes (CVE-2026-22852, CVE-2026-22854, CVE-2026-22855,       CVE-2026-22856, CVE-2026-22858, CVE-2026-22859, CVE-2026-23530,       CVE-2026-23531, CVE-2026-23532, CVE-2026-23533, CVE-2026-23534,       CVE-2026-23732, CVE-2026-23883, CVE-2026-23884, CVE-2026-23948,       CVE-2026-24491, CVE-2026-24675, CVE-2026-24676, CVE-2026-24679,       CVE-2026-24681, CVE-2026-24683, CVE-2026-24684, CVE-2026-25952,       CVE-2026-26955, CVE-2026-26965, CVE-2026-26986, CVE-2026-27951,       CVE-2026-29775, CVE-2026-31806, CVE-2026-31883, CVE-2026-31884,       CVE-2026-31885, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985,       CVE-2026-45700, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299 and       CVE-2026-68580)       Resolves: rhbz#2430919, rhbz#2430908, rhbz#2430898, rhbz#2430914, rhbz#2430903       Resolves: rhbz#2430924, rhbz#2430933, rhbz#2429808, rhbz#2429823, rhbz#2429794       Resolves: rhbz#2443146, rhbz#2442975, rhbz#2429799, rhbz#2429814, rhbz#2429821       Resolves: rhbz#2438309, rhbz#2438321, rhbz#2438308, rhbz#2438328, rhbz#2438324       Resolves: rhbz#2438302, rhbz#2438310, rhbz#2438300, rhbz#2447394, rhbz#2453243       Resolves: rhbz#2453240, rhbz#2442837, rhbz#2442810, rhbz#2447426, rhbz#2447422       Resolves: rhbz#2447413, rhbz#2447416, rhbz#2453247, rhbz#2442857, rhbz#2491683       Resolves: rhbz#2510295, rhbz#2510643, rhbz#2503646, rhbz#2510448

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0751 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-25952:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0,     xf_SetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xf_rail_get_window in     xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table, and the main     thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is     still using the pointer. Version 3.23.0 fixes the issue.

    CVE-2026-26986:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, rail_window_free     dereferences a freed xfAppWindow pointer during HashTable_Free cleanup because xf_rail_window_common calls     free(appWindow) on title allocation failure without first removing the entry from the railWindows hash     table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the     vulnerability.

    CVE-2026-27951:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function     Stream_EnsureCapacity can create an endless blocking loop. This may affect all client and server     implementations using FreeRDP. For practical exploitation this will only work on 32bit systems where the     available physical memory is >= SIZE_MAX. Version 3.23.0 contains a patch. No known workarounds are     available.

    CVE-2026-29775:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-     of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in     bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells,     bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is     fixed in 3.24.0.

    CVE-2026-31883:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in     the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio     channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a     size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such     that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header     (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an     astronomical number of iterations. This vulnerability is fixed in 3.24.0.

    CVE-2026-31884:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-     ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both     ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The     nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not     validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE     (floating point exception) crash. This vulnerability is fixed in 3.24.0.

    CVE-2026-31885:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-     bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input     data. This vulnerability is fixed in 3.24.0.

    CVE-2026-33985:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from     adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue     has been patched in version 3.24.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315484	RHEL 10 : freerdp (RHSA-2026:19142)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/6/2	medium
314289	Oracle Linux 8 : freerdp (ELSA-2026-16019)	Nessus	Oracle Linux Local Security Checks	2026/5/12	2026/5/22	medium
314381	RHEL 9 : freerdp (RHSA-2026:16485)	Nessus	Red Hat Local Security Checks	2026/5/13	2026/6/4	medium
314387	RHEL 9 : freerdp (RHSA-2026:16482)	Nessus	Red Hat Local Security Checks	2026/5/13	2026/6/4	medium
314438	AlmaLinux 10 : freerdp (ALSA-2026:16014)	Nessus	Alma Linux Local Security Checks	2026/5/13	2026/6/4	medium
314460	Oracle Linux 9 : freerdp (ELSA-2026-16482)	Nessus	Oracle Linux Local Security Checks	2026/5/13	2026/6/4	medium
314497	RHEL 9 : freerdp (RHSA-2026:16865)	Nessus	Red Hat Local Security Checks	2026/5/13	2026/6/4	medium
315080	AlmaLinux 9 : freerdp (ALSA-2026:16482)	Nessus	Alma Linux Local Security Checks	2026/5/16	2026/7/2	medium
304610	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1520)	Nessus	Amazon Linux Local Security Checks	2026/4/1	2026/4/1	critical
328990	Oracle Linux 10 : freerdp (ELSA-2026-19142)	Nessus	Oracle Linux Local Security Checks	2026/7/22	2026/7/22	medium
314363	RHEL 9 : freerdp (RHSA-2026:16483)	Nessus	Red Hat Local Security Checks	2026/5/12	2026/6/4	medium
316584	Alibaba Cloud Linux 3 : 0116: freerdp (ALINUX3-SA-2026:0116)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/5/25	2026/5/25	medium
316712	TencentOS Server 3: freerdp (TSSA-2026:0388)	Nessus	Tencent Local Security Checks	2026/5/26	2026/5/26	medium
342220	Fedora 46 : freerdp2 (2026-1c0deda1e7)	Nessus	Fedora Local Security Checks	2026/9/1	2026/9/1	critical
329208	TencentOS Server 2: freerdp (TSSA-2026:0751)	Nessus	Tencent Local Security Checks	2026/7/23	2026/9/3	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

critical

medium