{"id":"CVE-2026-33986","aliases":["ALPINE-CVE-2026-33986","DEBIAN-CVE-2026-33986","EUVD-2026-17233","GHSA-h6qw-wxvm-hf97","MGASA-2026-0383","SUSE-SU-2026:21436-1","SUSE-SU-2026:22194-1","SUSE-SU-2026:3562-1","UBUNTU-CVE-2026-33986","USN-8561-1","openSUSE-SU-2026:10633-1","openSUSE-SU-2026:20657-1","openSUSE-SU-2026:21116-1"],"status":"published","title":"FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00269,"percentile":0.19253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-131"],"published":"2026-03-30T21:43:21Z","modified":"2026-11-03T06:32:54Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"freerdp","fixed_in":["3.24.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"freerdp","fixed_in":["3.24.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freerdp3","fixed_in":["3.15.0+dfsg-2.1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.24.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0+dfsg-2.1+deb13u2"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0-1.mga10"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-160000.1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-160000.1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150700.3.17.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150700.3.17.1"}]}],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0+dfsg-1ubuntu1","3.15.0+dfsg-2.1","3.16.0+dfsg-1ubuntu1","3.16.0+dfsg-2","3.16.0+dfsg-2ubuntu0.1","3.16.0+dfsg-2ubuntu0.3","3.16.0+dfsg-2ubuntu0.4","3.16.0+dfsg-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"],"bundled":34},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-160000.1.1"}]}],"bundled":11}],"products":[{"vendor":"freerdp","product":"freerdp"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/f6e43e208958140074ae9bb93cd0c9045a371c77","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33986","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453221","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33986.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33986","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33986.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33986","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33986","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0383.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35315","tags":["report"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.26.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.27.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.27.1","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.28.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.29.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.30.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases#release-3.31.0","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621436-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258919","tags":["report"]},{"url":"https://bugzilla.suse.com/1258920","tags":["report"]},{"url":"https://bugzilla.suse.com/1258921","tags":["report"]},{"url":"https://bugzilla.suse.com/1258923","tags":["report"]},{"url":"https://bugzilla.suse.com/1258924","tags":["report"]},{"url":"https://bugzilla.suse.com/1258973","tags":["report"]},{"url":"https://bugzilla.suse.com/1258976","tags":["report"]},{"url":"https://bugzilla.suse.com/1258977","tags":["report"]},{"url":"https://bugzilla.suse.com/1258979","tags":["report"]},{"url":"https://bugzilla.suse.com/1258982","tags":["report"]},{"url":"https://bugzilla.suse.com/1258985","tags":["report"]},{"url":"https://bugzilla.suse.com/1259653","tags":["report"]},{"url":"https://bugzilla.suse.com/1259679","tags":["report"]},{"url":"https://bugzilla.suse.com/1259680","tags":["report"]},{"url":"https://bugzilla.suse.com/1259684","tags":["report"]},{"url":"https://bugzilla.suse.com/1259686","tags":["report"]},{"url":"https://bugzilla.suse.com/1259689","tags":["report"]},{"url":"https://bugzilla.suse.com/1259692","tags":["report"]},{"url":"https://bugzilla.suse.com/1259693","tags":["report"]},{"url":"https://bugzilla.suse.com/1261196","tags":["report"]},{"url":"https://bugzilla.suse.com/1261198","tags":["report"]},{"url":"https://bugzilla.suse.com/1261200","tags":["report"]},{"url":"https://bugzilla.suse.com/1261211","tags":["report"]},{"url":"https://bugzilla.suse.com/1261217","tags":["report"]},{"url":"https://bugzilla.suse.com/1261222","tags":["report"]},{"url":"https://bugzilla.suse.com/1261223","tags":["report"]},{"url":"https://bugzilla.suse.com/1261226","tags":["report"]},{"url":"https://bugzilla.suse.com/1261227","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33995","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622194-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174200","tags":["report"]},{"url":"https://bugzilla.suse.com/1262743","tags":["report"]},{"url":"https://bugzilla.suse.com/1266317","tags":["report"]},{"url":"https://bugzilla.suse.com/1267008","tags":["report"]},{"url":"https://bugzilla.suse.com/1267009","tags":["report"]},{"url":"https://bugzilla.suse.com/1267010","tags":["report"]},{"url":"https://bugzilla.suse.com/1267011","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45700","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263562-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258939","tags":["report"]},{"url":"https://bugzilla.suse.com/1271071","tags":["report"]},{"url":"https://bugzilla.suse.com/1271303","tags":["report"]},{"url":"https://bugzilla.suse.com/1271304","tags":["report"]},{"url":"https://bugzilla.suse.com/1271305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57158","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33986","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8561-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57158","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33986","title":"FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T21:43:21.951Z","modified":"2026-07-15T01:05:01.229Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122","CWE-131","CWE-131"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-17233","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T21:43:21Z","modified":"2026-07-15T01:05:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"nvd":[{"id":"CVE-2026-33986","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T22:16:19.87Z","modified":"2026-07-15T02:20:27.44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122","CWE-131"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"ALPINE-CVE-2026-33986","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T22:16:19.87Z","modified":"2026-11-03T06:32:54.777484527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-33986","title":"FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T21:43:21.951Z","modified":"2026-11-08T07:11:21.392367773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-131"],"updated_at":"2026-11-08T02:57:14.556074Z"},{"id":"DEBIAN-CVE-2026-33986","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T22:16:19.87Z","modified":"2026-10-01T03:03:10.610052992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-33986","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264-\u003ewidth and h264-\u003eheight are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.","status":"published","published":"2026-03-30T22:16:00Z","modified":"2026-07-21T13:08:45.952784145Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"MGASA-2026-0383","title":"Updated freerdp packages fix security vulnerabilities","description":"Updated packages bring lot of security fixes. Please see the links for\nadditional information.\n","status":"published","published":"2026-09-08T02:47:35Z","modified":"2026-09-08T12:40:27.9536564Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10633-1","title":"freerdp-3.24.2-1.1 on GA media","description":"These are all security issues fixed in the freerdp-3.24.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-04-29T08:01:11.461964Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20657-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nUpdate to version 3.24.2.\n\nSecurity issues fixed:\n\n- CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).\n- CVE-2026-25942: buffer overflow of global array in `xf_rail_server_execute_result` (bsc#1258920).\n- CVE-2026-25952: heap use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).\n- CVE-2026-25953: heap use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).\n- CVE-2026-25954: heap use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).\n- CVE-2026-25955: heap use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258973).\n- CVE-2026-25959: heap use-after-free in `xf_cliprdr_provide_data_` (bsc#1258976).\n- CVE-2026-25997: heap use-after-free in `xf_clipboard_format_equal` (bsc#1258977).\n- CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).\n- CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).\n- CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).\n- CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).\n- CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).\n- CVE-2026-29776: integer underflow in `update_read_cache_bitmap_order` (bsc#1259692).\n- CVE-2026-31806: heap buffer overflow in `nsc_process_message` (bsc#1259653).\n- CVE-2026-31883: heap buffer overwrite due to a `size_t` underflow in the IMA-ADPCM and MS-ADPCM audio decoders\n  (bsc#1259679).\n- CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).\n- CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).\n- CVE-2026-31897: out-of-bounds read in `freerdp_bitmap_decompress_planar` (bsc#1259693).\n- CVE-2026-33952: client-side crash due to `WINPR_ASSERT()` failure in `rts_read_auth_verifier_no_checks()`\n  (bsc#1261196).\n- CVE-2026-33977: client-side crash due to `WINPR_ASSERT()` failure in IMA ADPCM audio decoder (bsc#1261198).\n- CVE-2026-33982: heap buffer overread in in `winpr_aligned_offset_recalloc` (bsc#1261222).\n- CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in\n  `progressive_decompress_tile_upgrade` (bsc#1261200).\n- CVE-2026-33984: heap buffer overflow in ClearCodec `resize_vbar_entry` (bsc#1261211).\n- CVE-2026-33985: heap out-of-bounds read in `clear_decompress_glyph_data` (bsc#1261217).\n- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).\n- CVE-2026-33995: double-free vulnerability in `kerberos_AcceptSecurityContext` and\n  `kerberos_InitializeSecurityContextA` (bsc#1261227).\n\nOther updates and bugfixes:\n\n- Version 3.24.2:\n  * [channels,video] fix wrong cast (#12511)\n  * [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)\n  * [client,sdl] create a copy of rdpPointer (#12512)\n  * [codec,video] properly pass intermediate format (#12518)\n  * [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr:\n    improve libunwind backtraces (#12530)\n  * [server,shadow] remember selected caps (#12528)\n  * Zero credential data before free in NLA and NTLM context (#12532)\n  * [server,proxy] ignore missing client in input channel (#12536)\n  * [server,proxy] ignore rdpdr messages (#12537)\n  * [winpr,sspi] improve kerberos logging (#12538)\n  * Codec fixes (#12542)\n\n- Version 3.24.1:\n  * [warnings] fix various sign and cast warnings (#12480)\n  * [client,x11] start with xfc-\u003eremote_app = TRUE; (#12491)\n  * Sam file read regression fix (#12484)\n  * [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)\n  * Fix: memory leak in rdp_client_establish_keys() (#12494)\n  * Fix memory leak in freerdp_settings_int_buffer_copy() on error paths (libfreerdp/core/settings.c) (#12486)\n  * Code Cleanups (#12493)\n  * Fix: memory leak in PCSC_SCardListReadersW() (#12495)\n  * [channels,telemetry] use dynamic logging (#12496)\n  * [channel,gfx] use generic plugin log (@12498, #12499)\n  * [channels,audin] set error when audio_format_read fails (#12500)\n  * [channels,video] unify error handling (#12502)\n  * Fastpath fine grained lock (#12503)\n  * [core,update] make the PlaySound callback non-mandatory (#12504)\n  * Refinements: RPM build updates, FIPS improvements (#12506)\n\n- Version 3.24.0:\n  * Completed the [[nodiscard]] marking of the API to warn about problematic\n  * unchecked use of functions\n  * Added full C23 support (default stays at C11) to allow new compilers\n  * to do stricter checking\n  * Improved X11 and SDL3 clients\n  * Improved smartcard support\n  * proxy now supports RFX graphics mode\n  * Attribute nodiscard related chanes (#12325, #12360, #12395, #12406, #12421, #12426, #12177, #12403, #12405, #12407,\n    #12409, #12408, #12412, #12413)\n  * c23 related improvements (#12368, #12371, #12379, #12381, #12383, #12385, #12386, #12387, #12384)\n  * Generic code cleanups (#12382, #12439, #12455, #12462, #12399, #12473) [core,utils] ignore NULL values in\n    remove_rdpdr_type (#12372)\n  * [codec,fdk] revert use of WinPR types (#12373)\n  * [core,gateway] ignore incomplete rpc header (#12375, #12376)\n  * [warnings] make function declaration names consistent (#12377)\n  * [libfreerdp] Add new define for logon error info (#12380)\n  * [client,x11] improve rails window locking (#12392)\n  * Reload fix missing null checks (#12396)\n  * Bounds checks (#12400)\n  * [server,proxy] check for nullptr before using scard_call_context (#12404)\n  * [uwac] fix rectangular glitch around surface damage regions (#12410)\n  * Address various error handling inconsistencies (#12411)\n  * [core,server] Improve WTS API locking (#12414)\n  * Address some GCC compile issues (#12415, #12420)\n  * Winpr atexit (#12416)\n  * [winpr,smartcard] fix function pointer casts (#12422)\n  * Xf timer fix (#12423)\n  * [client,sdl] workaround for wlroots compositors (#12425)\n  * [client,sdl] fix SdlWindow::query (#12378)\n  * [winpr,smartcard] fix PCSC_ReleaseCardContext (#12427)\n  * [client,x11] eliminate obsolete compile flags (#12428)\n  * [client,common] skip sending input events when not connected (#12429)\n  * Input connected checks (#12430)\n  * Floatbar and display channel improvements (#12431)\n  * [winpr,platform] fix WINPR_ATTR_NODISCARD definition (#12432)\n  * [client] Fix writing of gatewayusagemethod to .rdp files (#12433)\n  * Nodiscard finetune (#12435)\n  * [core] fix missing gateway credential sync (#12436)\n  * [client,sdl3] limit FREERDP_WLROOTS_HACK (#12441)\n  * [core,settings] Allow FreeRDP_instance in setter (#12442)\n  * [codec,h264] make log message trace (#12444)\n  * X11 rails improve (#12440)\n  * [codec,nsc] limit copy area in nsc_process_message (#12448)\n  * Proxy support RFX and NSC settings (#12449)\n  * [client,common] display a shortened help on parsing issues (#12450)\n  * [winpr,smartcard] refine locking for pcsc layer (#12451)\n  * [codec,swscale] allow runtime loading of swscale (#12452)\n  * Swscale fallback (#12454)\n  * Sdl multi scaling support (#12456)\n  * [packaging,flatpak] update runtime and dependencies (#12457)\n  * [codec,video] add doxygen version details (#12458)\n  * [github,templates] update templates (#12460)\n  * [client,sdl] allow FREERDP_WLROOTS_HACK for all sessions (#12461)\n  * [warnings,nodiscard] add log messages for failures (#12463)\n  * [gdi,gdi] ignore empty rectangles (#12467)\n  * Smartcard fix smartcard-login, pass rdpContext for abort (#12466)\n  * [winpr,smartcard] fix compiler warnings (#12469)\n  * [winpr,timezone] fix search for transition dates (#12468)\n  * [client,common] improve /p help (#12471)\n  * Scard logging refactored (#12472)\n  * [emu,scard] fix smartcard emulation (#12475)\n  * Sdl null cursor (#12474)\n\n- Version 3.23.0:\n  * Sdl cleanup (#12202)\n  * [client,sdl] do not apply window offset (#12205)\n  * [client,sdl] add SDL_Error to exceptions (#12214)\n  * Rdp monitor log (#12215)\n  * [winpr,smartcard] implement some attributes (#12213)\n  * [client,windows] Fix return value checks for mouse event functions (#12279)\n  * [channels,rdpecam] fix sws context checks (#12272)\n  * [client,windows] Enhance error handling and context validation (#12264)\n  * [client,windows] Add window handle validation in RDP_EVENT_TYPE_WINDOW_NEW (#12261)\n  * [client,sdl] fix multimon/fullscreen on wayland (#12248)\n  * Vendor by app (#12207)\n  * [core,gateway] relax TSG parsing (#12283)\n  * [winpr,smartcard] simplify PCSC_ReadDeviceSystemName (#12273)\n  * [client,windows] Implement complete keyboard indicator synchronization (#12268)\n  * Fixes more more more (#12286)\n  * Use application details for names (#12285)\n  * warning cleanups (#12289)\n  * Warning cleanup (#12291)\n  * [client,windows] Enhance memory safety with NULL checks and resource protection (#12271)\n  * [client,x11] apply /size:xx% only once (#12293)\n  * Freerdp config test (#12295)\n  * [winpr,smartcard] fix returned attribute length (#12296)\n  * [client,SDL3] Fix properly handle smart-sizing with fullscreen (#12298)\n  * [core,test] fix use after free (#12299)\n  * Sign warnings (#12300)\n  * [cmake,compiler] disable -Wjump-misses-init (#12301)\n  * [codec,color] fix input length checks (#12302)\n  * [client,sdl] improve cursor updates, fix surface sizes (#12303)\n  * Sdl fullscreen (#12217)\n  * [client,sdl] fix move constructor of SdlWindow (#12305)\n  * [utils,smartcard] check stream length on padding (#12306)\n  * [android] Fix invert scrolling default value mismatch (#12309)\n  * Clear fix bounds checks (#12310)\n  * Winpr attr nodiscard fkt ptr (#12311)\n  * [codec,planar] fix missing destination bounds checks (#12312)\n  * [codec,clear] fix destination checks (#12315)\n  * NSC Codec fixes (#12317)\n  * Freerdp api nodiscard (#12313)\n  * [allocations] fix growth of preallocated buffers (#12319)\n  * Rdpdr simplify (#12320)\n  * Resource fix (#12323)\n  * [winpr,utils] ensure message queue capacity (#12322)\n  * [server,shadow] fix return and parameter checks (#12330)\n  * Shadow fixes (#12331)\n  * [rdtk,nodiscard] mark rdtk API nodiscard (#12329)\n  * [client,x11] fix XGetWindowProperty return handling (#12334)\n  * Win32 signal (#12335)\n  * [channel,usb] fix message parsing and creation (#12336)\n  * [cmake] Define WINPR_DEFINE_ATTR_NODISCARD (#12338)\n  * Proxy config fix (#12345)\n  * [codec,progressive] refine progressive decoding (#12347)\n  * [client,sdl] fix sdl_Pointer_New (#12350)\n  * [core,gateway] parse [MS-TSGU] 2.2.10.5 HTTP_CHANNEL_RESPONSE_OPTIONAL (#12353)\n  * X11 kbd sym (#12354)\n  * Windows compile warning fixes (#12357,#12358,#12359)\n","status":"published","published":"2026-04-30T16:54:03Z","modified":"2026-05-05T18:23:59.134007Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21116-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues\n\nUpdate to version 3.26.0:\n\n- CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in\n  winpr_aligned_offset_recalloc() (bsc#1261222).\n- CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).\n- CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).\n- CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and\n  kerberos_InitializeSecurityContextA() (bsc#1261227).\n- CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of service or achieve\n  remote execute code (bsc#1266317).\n- CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).\n- CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-\n  side clipboard (cliprdr) channel (bsc#1267008).\n- CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client\n  by sending crafted RDPGFX PDUs (bsc#1267009).\n- CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP\n  client's RDPEAR authentication-redirection path exists (bsc#1267010).\n- CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing\n  planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).\n\nChanges:\n\n * cmake: Findyuv: Use correct pkgconfig name (#12666)\n * Remove deallocator attribute from rfx_message_free (#12681)\n * [winpr,utils] improve winpr/ntlm.h (#12677)\n * rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)\n * fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)\n * [core,instance] fix deprecation guards (#12691)\n * [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)\n * Add VideoToolbox H.264 support for ffmpeg (#12694)\n * [client,common] add /args-from:file: syntax (#12697)\n * [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)\n * [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,\n * #12731, #12736, #12737, #12688)\n * [cmake,deps] use alias target for sso-mib (#12706)\n * [core,settings] add auto reconnect triggered flag (#12709)\n * Force YUV420P when videotoolbox is used (#12711)\n * Release cleanups (#12712)\n * [gdi,gfx] fix bounds checks and proxy unit tests (#12713)\n * Improved input checks (#12714)\n * [winpr,utils] add unit tests for command line parser (#12716)\n * Cmdline fixes (#12717)\n * [codec,planar] fix bounds checks (#12718)\n * [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)\n * [winpr,sspi] clean up ntlm code (#12732)\n * Experimental AV1 support has been added. This currently works only with FreeRDP based servers.\n * Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)\n * Android client received a (small) facelift\n * Improved SDL3 client drawing performance\n * Console output support for SDL3 (windows) and windows native client\n * RDP proxy now supports NSCodec and RFX modes.\n * RDP PRoxy now has smartcard emulation and SAM file support (via config file)\n * Smartcard KSP support for NLA authentication\n * [winpr,wlog] add WLog_SetGlobalPrefix (#12497)\n * [channels,video] fix wrong cast (#12511)\n * [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)\n * [client,sdl] create a copy of rdpPointer (#12512)\n * [codec,video] properly pass intermediate format (#12518)\n * [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)\n * winpr: improve libunwind backtraces (#12530)\n * [server,shadow] remember selected caps (#12528)\n * Zero credential data before free in NLA and NTLM context (#12532)\n * [server,proxy] ignore missing client in input channel (#12536)\n * [server,proxy] ignore rdpdr messages (#12537)\n * [winpr,sspi] improve kerberos logging (#12538)\n * Codec fixes (#12542)\n * [winpr,sspi] Fix context nullptr handling (#12543)\n * Dev 3.24.3 dev0 (#12545)\n * Fix memory leak in gdi_create_bitmap() on gdi_CreateBitmap failure (libfreerdp/gdi/graphics.c) (#12547)\n * Fix memory leak in vgids_read_do_fkt() on Stream_New failure (libfreerdp/emu/scard/smartcard_virtual_gids.c) (#12548)\n * Proxy config improve (#12549)\n * Proxy config improve (#12550)\n * [client,sdl] clamp cursor hotspot (#12553)\n * RFC: Research/av1 codec extension (#12527)\n * [winpr,kerberos] fix krb_log_context_encryption (#12555)\n * [client,sdl] fix global init return check (#12558)\n * Fix remote credential with windows11h2 (#12560)\n * Proxy scard auth improvements (#12561)\n * [winpr,sspi] guard krb5_get_etype_info (#12562)\n * [utils,smartcard] fix STATUS_BUFFER_TOO_SMALL (#12564)\n * [client,common] do not manipulate security settings for smartcard-logon (#12567)\n * [channels,audin] fix regression for microphone (#12570)\n * [client,sdl] add SDL_KMOD_MODE and SDL_KMOD_LEVEL5 (#12569)\n * Fix unbound strlen on slotDescription (#12571)\n * build: Update FindFFmpeg.cmake to support Apple frameworks with 'lib' prefix (#12565)\n * [channels,rdpewa] add WebAuthn virtual channel support (#12572)\n * [core] fix freerdp_get_nla_sspi_error always returning 0 on client (#12574)\n * [ci] enable rdpewa channel (#12576)\n * small refactoring (#12578)\n * Rdpewa unify notifications (#12581)\n * [client,sdl] fix crash when clicking 'cancel' on PIN popup (#12580)\n * [channels,drive] refine bounds checks (#12584)\n * fix: smartcard logon with ECC keys and minidriver-assigned container names (#12585)\n * Various papercuts (#12583)\n * fix: console output on Windows client (#12573)\n * [winpr,crt] dump stack on aligned memory errors (#12588)\n * [client,x11] keep scancode input for Ctrl/Alt/Super combinations in /kbd:unicode mode (#12590)\n * [codec,progressive] fix underflow guard in progressive_rfx_quant_sub (#12592)\n * fix: wfreerdp floatbar visibility (#12594)\n * [winpr,json] return a copy from WINPR_JSON_Print* (#12595)\n * [client,sdl] drop WITH_DEBUG_SDL_EVENTS (#12599)\n * Ncrypt and asn1 cleanup (#12604)\n * Video channel fix (#12593)\n * [codec,h264] fix media foundation backend (#12606)\n * fix(sdl): detect Hyprland and river in tryFallback() (#12608)\n * Proxy stress fixes (#12597)\n * Add new fuzzer tests (#12613)\n * fix(sdl): use SDL_Renderer instead of software surfaces (#12607)\n * fix(sdl): BFS neighbor walk pop/begin mismatch in addOrUpdateDisplay (#12614)\n * fix(sdl): promote first monitor as primary when subset excludes primary (#12618)\n * [ci,android] default to only aarch64 (#12622)\n * Fix process exit code on non-pidfd platforms (macOS, BSD)#12534) (#12586)\n * warning cleanups (#12626)\n * fix: prevent PostQuitMessage in RemoteApp WM_DESTROY handler (#12629)\n * [winpr,ntlm] fix message cleanup across the SSPI lifecycle (#12609)\n * Code bug fixes (#12632)\n * Oss fixes (#12633)\n * [client,android] add an option to enable keeping screen on when connected (#12630)\n * [client, android] Fix layout overlaps, migrate to AndroidX, and update UI components (#12628)\n * Proxy config tests (#12636)\n * Proxy config optional targethost (#12637)\n * [client,sdl] set SDL_HINT_SCREENSAVER_INHIBIT_ACTIVITY_NAME (#12639)\n * Nightly deb fix (#12640, #12641, #12649, #12650, #12642, #12643)\n * [winpr,input] fix korean keyboard mapping (#12646)\n * [client,sdl] set hints before SDL_Init (#12644)\n * Sdl inhibit option (#12647)\n * [client,X11] fix residual race in xf_clipboard_formats_free (#12648)\n * (sdl3): Fix oversized window on HiDPI Wayland (#12635)\n * [cache,bitmap] fix off-by-one in bitmap_cache_put bounds check (#12651)\n * [winpr,sspi] free fields buffer immediately (#12654)\n * [codec,dsp] fix fencepost error in dsp_ima_clamp_step (#12655)\n * RDPECAM MJPEG support\n * Support for FDK-AAC for sound and microphone redirection\n * Support timezones as JSON resources\n * Rely preferably on pkgconfig to pull devel packages instead of\n * A new option /cert that unifies all certificate related options (gh#FreeRDP/FreeRDP#5880)\n","status":"published","published":"2026-06-20T06:54:39Z","modified":"2026-06-30T18:24:42.695507415Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21436-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nUpdate to version 3.24.2.\n\nSecurity issues fixed:\n\n- CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).\n- CVE-2026-25942: buffer overflow of global array in `xf_rail_server_execute_result` (bsc#1258920).\n- CVE-2026-25952: heap use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).\n- CVE-2026-25953: heap use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).\n- CVE-2026-25954: heap use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).\n- CVE-2026-25955: heap use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258973).\n- CVE-2026-25959: heap use-after-free in `xf_cliprdr_provide_data_` (bsc#1258976).\n- CVE-2026-25997: heap use-after-free in `xf_clipboard_format_equal` (bsc#1258977).\n- CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).\n- CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).\n- CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).\n- CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).\n- CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).\n- CVE-2026-29776: integer underflow in `update_read_cache_bitmap_order` (bsc#1259692).\n- CVE-2026-31806: heap buffer overflow in `nsc_process_message` (bsc#1259653).\n- CVE-2026-31883: heap buffer overwrite due to a `size_t` underflow in the IMA-ADPCM and MS-ADPCM audio decoders\n  (bsc#1259679).\n- CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).\n- CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).\n- CVE-2026-31897: out-of-bounds read in `freerdp_bitmap_decompress_planar` (bsc#1259693).\n- CVE-2026-33952: client-side crash due to `WINPR_ASSERT()` failure in `rts_read_auth_verifier_no_checks()`\n  (bsc#1261196).\n- CVE-2026-33977: client-side crash due to `WINPR_ASSERT()` failure in IMA ADPCM audio decoder (bsc#1261198).\n- CVE-2026-33982: heap buffer overread in in `winpr_aligned_offset_recalloc` (bsc#1261222).\n- CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in\n  `progressive_decompress_tile_upgrade` (bsc#1261200).\n- CVE-2026-33984: heap buffer overflow in ClearCodec `resize_vbar_entry` (bsc#1261211).\n- CVE-2026-33985: heap out-of-bounds read in `clear_decompress_glyph_data` (bsc#1261217).\n- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).\n- CVE-2026-33995: double-free vulnerability in `kerberos_AcceptSecurityContext` and\n  `kerberos_InitializeSecurityContextA` (bsc#1261227).\n\nOther updates and bugfixes:\n\n- Version 3.24.2:\n  * [channels,video] fix wrong cast (#12511)\n  * [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)\n  * [client,sdl] create a copy of rdpPointer (#12512)\n  * [codec,video] properly pass intermediate format (#12518)\n  * [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr:\n    improve libunwind backtraces (#12530)\n  * [server,shadow] remember selected caps (#12528)\n  * Zero credential data before free in NLA and NTLM context (#12532)\n  * [server,proxy] ignore missing client in input channel (#12536)\n  * [server,proxy] ignore rdpdr messages (#12537)\n  * [winpr,sspi] improve kerberos logging (#12538)\n  * Codec fixes (#12542)\n\n- Version 3.24.1:\n  * [warnings] fix various sign and cast warnings (#12480)\n  * [client,x11] start with xfc-\u003eremote_app = TRUE; (#12491)\n  * Sam file read regression fix (#12484)\n  * [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)\n  * Fix: memory leak in rdp_client_establish_keys() (#12494)\n  * Fix memory leak in freerdp_settings_int_buffer_copy() on error paths (libfreerdp/core/settings.c) (#12486)\n  * Code Cleanups (#12493)\n  * Fix: memory leak in PCSC_SCardListReadersW() (#12495)\n  * [channels,telemetry] use dynamic logging (#12496)\n  * [channel,gfx] use generic plugin log (@12498, #12499)\n  * [channels,audin] set error when audio_format_read fails (#12500)\n  * [channels,video] unify error handling (#12502)\n  * Fastpath fine grained lock (#12503)\n  * [core,update] make the PlaySound callback non-mandatory (#12504)\n  * Refinements: RPM build updates, FIPS improvements (#12506)\n\n- Version 3.24.0:\n  * Completed the [[nodiscard]] marking of the API to warn about problematic\n  * unchecked use of functions\n  * Added full C23 support (default stays at C11) to allow new compilers\n  * to do stricter checking\n  * Improved X11 and SDL3 clients\n  * Improved smartcard support\n  * proxy now supports RFX graphics mode\n  * Attribute nodiscard related chanes (#12325, #12360, #12395, #12406, #12421, #12426, #12177, #12403, #12405, #12407,\n    #12409, #12408, #12412, #12413)\n  * c23 related improvements (#12368, #12371, #12379, #12381, #12383, #12385, #12386, #12387, #12384)\n  * Generic code cleanups (#12382, #12439, #12455, #12462, #12399, #12473) [core,utils] ignore NULL values in\n    remove_rdpdr_type (#12372)\n  * [codec,fdk] revert use of WinPR types (#12373)\n  * [core,gateway] ignore incomplete rpc header (#12375, #12376)\n  * [warnings] make function declaration names consistent (#12377)\n  * [libfreerdp] Add new define for logon error info (#12380)\n  * [client,x11] improve rails window locking (#12392)\n  * Reload fix missing null checks (#12396)\n  * Bounds checks (#12400)\n  * [server,proxy] check for nullptr before using scard_call_context (#12404)\n  * [uwac] fix rectangular glitch around surface damage regions (#12410)\n  * Address various error handling inconsistencies (#12411)\n  * [core,server] Improve WTS API locking (#12414)\n  * Address some GCC compile issues (#12415, #12420)\n  * Winpr atexit (#12416)\n  * [winpr,smartcard] fix function pointer casts (#12422)\n  * Xf timer fix (#12423)\n  * [client,sdl] workaround for wlroots compositors (#12425)\n  * [client,sdl] fix SdlWindow::query (#12378)\n  * [winpr,smartcard] fix PCSC_ReleaseCardContext (#12427)\n  * [client,x11] eliminate obsolete compile flags (#12428)\n  * [client,common] skip sending input events when not connected (#12429)\n  * Input connected checks (#12430)\n  * Floatbar and display channel improvements (#12431)\n  * [winpr,platform] fix WINPR_ATTR_NODISCARD definition (#12432)\n  * [client] Fix writing of gatewayusagemethod to .rdp files (#12433)\n  * Nodiscard finetune (#12435)\n  * [core] fix missing gateway credential sync (#12436)\n  * [client,sdl3] limit FREERDP_WLROOTS_HACK (#12441)\n  * [core,settings] Allow FreeRDP_instance in setter (#12442)\n  * [codec,h264] make log message trace (#12444)\n  * X11 rails improve (#12440)\n  * [codec,nsc] limit copy area in nsc_process_message (#12448)\n  * Proxy support RFX and NSC settings (#12449)\n  * [client,common] display a shortened help on parsing issues (#12450)\n  * [winpr,smartcard] refine locking for pcsc layer (#12451)\n  * [codec,swscale] allow runtime loading of swscale (#12452)\n  * Swscale fallback (#12454)\n  * Sdl multi scaling support (#12456)\n  * [packaging,flatpak] update runtime and dependencies (#12457)\n  * [codec,video] add doxygen version details (#12458)\n  * [github,templates] update templates (#12460)\n  * [client,sdl] allow FREERDP_WLROOTS_HACK for all sessions (#12461)\n  * [warnings,nodiscard] add log messages for failures (#12463)\n  * [gdi,gdi] ignore empty rectangles (#12467)\n  * Smartcard fix smartcard-login, pass rdpContext for abort (#12466)\n  * [winpr,smartcard] fix compiler warnings (#12469)\n  * [winpr,timezone] fix search for transition dates (#12468)\n  * [client,common] improve /p help (#12471)\n  * Scard logging refactored (#12472)\n  * [emu,scard] fix smartcard emulation (#12475)\n  * Sdl null cursor (#12474)\n\n- Version 3.23.0:\n  * Sdl cleanup (#12202)\n  * [client,sdl] do not apply window offset (#12205)\n  * [client,sdl] add SDL_Error to exceptions (#12214)\n  * Rdp monitor log (#12215)\n  * [winpr,smartcard] implement some attributes (#12213)\n  * [client,windows] Fix return value checks for mouse event functions (#12279)\n  * [channels,rdpecam] fix sws context checks (#12272)\n  * [client,windows] Enhance error handling and context validation (#12264)\n  * [client,windows] Add window handle validation in RDP_EVENT_TYPE_WINDOW_NEW (#12261)\n  * [client,sdl] fix multimon/fullscreen on wayland (#12248)\n  * Vendor by app (#12207)\n  * [core,gateway] relax TSG parsing (#12283)\n  * [winpr,smartcard] simplify PCSC_ReadDeviceSystemName (#12273)\n  * [client,windows] Implement complete keyboard indicator synchronization (#12268)\n  * Fixes more more more (#12286)\n  * Use application details for names (#12285)\n  * warning cleanups (#12289)\n  * Warning cleanup (#12291)\n  * [client,windows] Enhance memory safety with NULL checks and resource protection (#12271)\n  * [client,x11] apply /size:xx% only once (#12293)\n  * Freerdp config test (#12295)\n  * [winpr,smartcard] fix returned attribute length (#12296)\n  * [client,SDL3] Fix properly handle smart-sizing with fullscreen (#12298)\n  * [core,test] fix use after free (#12299)\n  * Sign warnings (#12300)\n  * [cmake,compiler] disable -Wjump-misses-init (#12301)\n  * [codec,color] fix input length checks (#12302)\n  * [client,sdl] improve cursor updates, fix surface sizes (#12303)\n  * Sdl fullscreen (#12217)\n  * [client,sdl] fix move constructor of SdlWindow (#12305)\n  * [utils,smartcard] check stream length on padding (#12306)\n  * [android] Fix invert scrolling default value mismatch (#12309)\n  * Clear fix bounds checks (#12310)\n  * Winpr attr nodiscard fkt ptr (#12311)\n  * [codec,planar] fix missing destination bounds checks (#12312)\n  * [codec,clear] fix destination checks (#12315)\n  * NSC Codec fixes (#12317)\n  * Freerdp api nodiscard (#12313)\n  * [allocations] fix growth of preallocated buffers (#12319)\n  * Rdpdr simplify (#12320)\n  * Resource fix (#12323)\n  * [winpr,utils] ensure message queue capacity (#12322)\n  * [server,shadow] fix return and parameter checks (#12330)\n  * Shadow fixes (#12331)\n  * [rdtk,nodiscard] mark rdtk API nodiscard (#12329)\n  * [client,x11] fix XGetWindowProperty return handling (#12334)\n  * Win32 signal (#12335)\n  * [channel,usb] fix message parsing and creation (#12336)\n  * [cmake] Define WINPR_DEFINE_ATTR_NODISCARD (#12338)\n  * Proxy config fix (#12345)\n  * [codec,progressive] refine progressive decoding (#12347)\n  * [client,sdl] fix sdl_Pointer_New (#12350)\n  * [core,gateway] parse [MS-TSGU] 2.2.10.5 HTTP_CHANNEL_RESPONSE_OPTIONAL (#12353)\n  * X11 kbd sym (#12354)\n  * Windows compile warning fixes (#12357,#12358,#12359)\n","status":"published","published":"2026-04-30T16:54:05Z","modified":"2026-05-05T18:23:52.45993Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22194-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues\n\nUpdate to version 3.26.0:\n\n- CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in\n  winpr_aligned_offset_recalloc() (bsc#1261222).\n- CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).\n- CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).\n- CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and\n  kerberos_InitializeSecurityContextA() (bsc#1261227).\n- CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of service or achieve\n  remote execute code (bsc#1266317).\n- CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).\n- CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-\n  side clipboard (cliprdr) channel (bsc#1267008).\n- CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client\n  by sending crafted RDPGFX PDUs (bsc#1267009).\n- CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP\n  client's RDPEAR authentication-redirection path exists (bsc#1267010).\n- CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing\n  planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).\n\nChanges:\n\n * cmake: Findyuv: Use correct pkgconfig name (#12666)\n * Remove deallocator attribute from rfx_message_free (#12681)\n * [winpr,utils] improve winpr/ntlm.h (#12677)\n * rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)\n * fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)\n * [core,instance] fix deprecation guards (#12691)\n * [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)\n * Add VideoToolbox H.264 support for ffmpeg (#12694)\n * [client,common] add /args-from:file: syntax (#12697)\n * [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)\n * [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,\n * #12731, #12736, #12737, #12688)\n * [cmake,deps] use alias target for sso-mib (#12706)\n * [core,settings] add auto reconnect triggered flag (#12709)\n * Force YUV420P when videotoolbox is used (#12711)\n * Release cleanups (#12712)\n * [gdi,gfx] fix bounds checks and proxy unit tests (#12713)\n * Improved input checks (#12714)\n * [winpr,utils] add unit tests for command line parser (#12716)\n * Cmdline fixes (#12717)\n * [codec,planar] fix bounds checks (#12718)\n * [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)\n * [winpr,sspi] clean up ntlm code (#12732)\n * Experimental AV1 support has been added. This currently works only with FreeRDP based servers.\n * Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)\n * Android client received a (small) facelift\n * Improved SDL3 client drawing performance\n * Console output support for SDL3 (windows) and windows native client\n * RDP proxy now supports NSCodec and RFX modes.\n * RDP PRoxy now has smartcard emulation and SAM file support (via config file)\n * Smartcard KSP support for NLA authentication\n * [winpr,wlog] add WLog_SetGlobalPrefix (#12497)\n * [channels,video] fix wrong cast (#12511)\n * [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)\n * [client,sdl] create a copy of rdpPointer (#12512)\n * [codec,video] properly pass intermediate format (#12518)\n * [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)\n * winpr: improve libunwind backtraces (#12530)\n * [server,shadow] remember selected caps (#12528)\n * Zero credential data before free in NLA and NTLM context (#12532)\n * [server,proxy] ignore missing client in input channel (#12536)\n * [server,proxy] ignore rdpdr messages (#12537)\n * [winpr,sspi] improve kerberos logging (#12538)\n * Codec fixes (#12542)\n * [winpr,sspi] Fix context nullptr handling (#12543)\n * Dev 3.24.3 dev0 (#12545)\n * Fix memory leak in gdi_create_bitmap() on gdi_CreateBitmap failure (libfreerdp/gdi/graphics.c) (#12547)\n * Fix memory leak in vgids_read_do_fkt() on Stream_New failure (libfreerdp/emu/scard/smartcard_virtual_gids.c) (#12548)\n * Proxy config improve (#12549)\n * Proxy config improve (#12550)\n * [client,sdl] clamp cursor hotspot (#12553)\n * RFC: Research/av1 codec extension (#12527)\n * [winpr,kerberos] fix krb_log_context_encryption (#12555)\n * [client,sdl] fix global init return check (#12558)\n * Fix remote credential with windows11h2 (#12560)\n * Proxy scard auth improvements (#12561)\n * [winpr,sspi] guard krb5_get_etype_info (#12562)\n * [utils,smartcard] fix STATUS_BUFFER_TOO_SMALL (#12564)\n * [client,common] do not manipulate security settings for smartcard-logon (#12567)\n * [channels,audin] fix regression for microphone (#12570)\n * [client,sdl] add SDL_KMOD_MODE and SDL_KMOD_LEVEL5 (#12569)\n * Fix unbound strlen on slotDescription (#12571)\n * build: Update FindFFmpeg.cmake to support Apple frameworks with 'lib' prefix (#12565)\n * [channels,rdpewa] add WebAuthn virtual channel support (#12572)\n * [core] fix freerdp_get_nla_sspi_error always returning 0 on client (#12574)\n * [ci] enable rdpewa channel (#12576)\n * small refactoring (#12578)\n * Rdpewa unify notifications (#12581)\n * [client,sdl] fix crash when clicking 'cancel' on PIN popup (#12580)\n * [channels,drive] refine bounds checks (#12584)\n * fix: smartcard logon with ECC keys and minidriver-assigned container names (#12585)\n * Various papercuts (#12583)\n * fix: console output on Windows client (#12573)\n * [winpr,crt] dump stack on aligned memory errors (#12588)\n * [client,x11] keep scancode input for Ctrl/Alt/Super combinations in /kbd:unicode mode (#12590)\n * [codec,progressive] fix underflow guard in progressive_rfx_quant_sub (#12592)\n * fix: wfreerdp floatbar visibility (#12594)\n * [winpr,json] return a copy from WINPR_JSON_Print* (#12595)\n * [client,sdl] drop WITH_DEBUG_SDL_EVENTS (#12599)\n * Ncrypt and asn1 cleanup (#12604)\n * Video channel fix (#12593)\n * [codec,h264] fix media foundation backend (#12606)\n * fix(sdl): detect Hyprland and river in tryFallback() (#12608)\n * Proxy stress fixes (#12597)\n * Add new fuzzer tests (#12613)\n * fix(sdl): use SDL_Renderer instead of software surfaces (#12607)\n * fix(sdl): BFS neighbor walk pop/begin mismatch in addOrUpdateDisplay (#12614)\n * fix(sdl): promote first monitor as primary when subset excludes primary (#12618)\n * [ci,android] default to only aarch64 (#12622)\n * Fix process exit code on non-pidfd platforms (macOS, BSD)#12534) (#12586)\n * warning cleanups (#12626)\n * fix: prevent PostQuitMessage in RemoteApp WM_DESTROY handler (#12629)\n * [winpr,ntlm] fix message cleanup across the SSPI lifecycle (#12609)\n * Code bug fixes (#12632)\n * Oss fixes (#12633)\n * [client,android] add an option to enable keeping screen on when connected (#12630)\n * [client, android] Fix layout overlaps, migrate to AndroidX, and update UI components (#12628)\n * Proxy config tests (#12636)\n * Proxy config optional targethost (#12637)\n * [client,sdl] set SDL_HINT_SCREENSAVER_INHIBIT_ACTIVITY_NAME (#12639)\n * Nightly deb fix (#12640, #12641, #12649, #12650, #12642, #12643)\n * [winpr,input] fix korean keyboard mapping (#12646)\n * [client,sdl] set hints before SDL_Init (#12644)\n * Sdl inhibit option (#12647)\n * [client,X11] fix residual race in xf_clipboard_formats_free (#12648)\n * (sdl3): Fix oversized window on HiDPI Wayland (#12635)\n * [cache,bitmap] fix off-by-one in bitmap_cache_put bounds check (#12651)\n * [winpr,sspi] free fields buffer immediately (#12654)\n * [codec,dsp] fix fencepost error in dsp_ima_clamp_step (#12655)\n * RDPECAM MJPEG support\n * Support for FDK-AAC for sound and microphone redirection\n * Support timezones as JSON resources\n * Rely preferably on pkgconfig to pull devel packages instead of\n * A new option /cert that unifies all certificate related options (gh#FreeRDP/FreeRDP#5880)\n","status":"published","published":"2026-06-20T06:53:51Z","modified":"2026-06-24T09:00:06.643436239Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:3562-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2026-27951: 32-bit system denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).\n- CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).\n- CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).\n- CVE-2026-33982: heap buffer overread in `winpr_aligned_offset_recalloc()` can lead to undefined behavior\n  (bsc#1261222).\n- CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80\n  billion iteration loop (bsc#1261200).\n- CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).\n- CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).\n- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap out-of-bounds write due to persistent cache `bmpSize` desync (bsc#1261226).\n- CVE-2026-33995: double-free in `kerberos_AcceptSecurityContext()` and `kerberos_InitializeSecurityContextA()` can\n  lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).\n- CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of service or achieve\n  remote code execution (bsc#1266317).\n- CVE-2026-40254: off-by-one error in `contains_dotdot()` allows for drive channel path traversal (bsc#1262743).\n- CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends\n  a `CB_CLIP_CAPS` PDU with a too-small `capabilitySetLength` (bsc#1267008).\n- CVE-2026-44421: improper validation in `gdi_CacheToSurface` can lead to a heap buffer overwrite client when an RDP\n  server sends crafted RDPGFX PDUs (bsc#1267009).\n- CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR\n  authentication-redirection path (bsc#1267010).\n- CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write\n  (bsc#1267011).\n- CVE-2026-56297: improper synchronization of `channel_callback` access can lead to use-after-free in\n  `dvcman_channel_close` and `dvcman_call_on_receive` triggered by a malicious RDP server (bsc#1271071).\n- CVE-2026-57156: integer overflow in `update_read_delta_points` allows malicious RDP peers to cause a heap buffer\n  overflow (bsc#1271303).\n- CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM `DeviceName` and `VirtualChannelName`\n  fields (bsc#1271304).\n- CVE-2026-57158: incomplete fix for CVE-2026-23530 in `planar_decompress_plane_rle_only` allows a malicious RDP server\n  to trigger a one byte buffer overflow via a truncated `RDPGFX_CMDID_WIRETOSURFACE_1` planar payload (bsc#1271305).\n","status":"published","published":"2026-08-10T18:16:39Z","modified":"2026-08-12T10:45:04.866306661Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8561-1","title":"freerdp3 vulnerabilities","description":"It was discovered that FreeRDP contained multiple security issues. An\nattacker could possibly use these issues to obtain sensitive information,\ncause FreeRDP to crash, resulting in a denial of service, or execute\narbitrary code.","status":"published","published":"2026-07-20T11:49:26Z","modified":"2026-10-01T00:17:47.242027428Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}