Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Security update for freerdp fixes multiple critical issues
published 6 months ago
Summary
This security update addresses multiple vulnerabilities in freerdp that could allow an attacker to crash the application, steal sensitive information, or disrupt service. Affected users should update their freerdp installations as soon as possible to prevent potential security risks. The update fixes a range of issues, including out-of-bounds reads, heap use-after-free errors, and denial of service conditions.
Original advisory text
Security update for freerdp
This update for freerdp fixes the following issues:
- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU (bsc#1258919).
- CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
- CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
- CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
- CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
- CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
- CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
- CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
- CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
- CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU (bsc#1258919).
- CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).
- CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).
- CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).
- CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).
- CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).
- CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).
- CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).
- CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).
- CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20261634-1/ Vendor Advisory
- https://bugzilla.suse.com/1258919 Third Party Advisory
- https://bugzilla.suse.com/1258920 Third Party Advisory
- https://bugzilla.suse.com/1258921 Third Party Advisory
- https://bugzilla.suse.com/1258923 Third Party Advisory
- https://bugzilla.suse.com/1258924 Third Party Advisory
- https://bugzilla.suse.com/1258939 Third Party Advisory
- https://bugzilla.suse.com/1258967 Third Party Advisory
- https://bugzilla.suse.com/1258977 Third Party Advisory
- https://bugzilla.suse.com/1258987 Third Party Advisory
- https://bugzilla.suse.com/1259680 Third Party Advisory
- https://bugzilla.suse.com/1259684 Third Party Advisory
- https://bugzilla.suse.com/1259689 Third Party Advisory
- https://bugzilla.suse.com/1259692 Third Party Advisory
- https://bugzilla.suse.com/1259693 Third Party Advisory
- https://bugzilla.suse.com/1261848 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-25941 URL
- https://www.suse.com/security/cve/CVE-2026-25942 URL
- https://www.suse.com/security/cve/CVE-2026-25952 URL
- https://www.suse.com/security/cve/CVE-2026-25953 URL
- https://www.suse.com/security/cve/CVE-2026-25954 URL
- https://www.suse.com/security/cve/CVE-2026-25997 URL
- https://www.suse.com/security/cve/CVE-2026-26986 URL
- https://www.suse.com/security/cve/CVE-2026-27015 URL
- https://www.suse.com/security/cve/CVE-2026-27951 URL
- https://www.suse.com/security/cve/CVE-2026-29774 URL
- https://www.suse.com/security/cve/CVE-2026-29775 URL
- https://www.suse.com/security/cve/CVE-2026-29776 URL
- https://www.suse.com/security/cve/CVE-2026-31884 URL
- https://www.suse.com/security/cve/CVE-2026-31897 URL
Timeline
Published27 Apr 2026
Updated28 Apr 2026
First seen28 Apr 2026
Sources
SUSE-SU-2026:1634-1 · OSV
Track software like this
Free during beta