{"id":"CVE-2026-63633","aliases":["ALSA-2026:61378","DEBIAN-CVE-2026-63633","EUVD-2026-62672","GHSA-72j9-356v-88xq","RHSA-2026:61378","RHSA-2026:68706","RLSA-2026:61378","UBUNTU-CVE-2026-63633","openSUSE-SU-2026:11385-1"],"status":"published","title":"FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00619,"percentile":0.5013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:30:48Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.28.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freerdp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1","3.32.1+dfsg-1","3.32.1+dfsg-1~bpo13+1","3.32.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"freerdp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"freerdp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-3.el10_0.16"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:10","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.10.3-12.el10_2.10"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0-1.1"}]}],"bundled":3}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12993","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","article"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0","tags":["x_refsource_MISC","Release Notes","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55194","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63633","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63652","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67288","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67291","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67296","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67297","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67298","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67301","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67304","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69159","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73241","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73242","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509986","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509994","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510001","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510010","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510029","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510034","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510041","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514346","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514349","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519822","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519826","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519828","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61378.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63633.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63633","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63633","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61378.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55194","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12873","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63633","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63652","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9g22-w2gr-vcmp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67288","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67291","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67296","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jm8r-22j6-4m4v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-rdpei-pdu","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67297","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2c6r-4pr4-9x8m","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-resource-exhaustion-via-chunked-http-response","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67298","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67301","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67304","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-null-dereference-via-smartcard-cleanup","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69159","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/75a1ec61d444179ea64a4ec0835214cb9c4f7c18","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/13016","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.29.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73241","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/13065","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6x","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73242","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73242","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68706","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519823","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68706.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67290","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61378","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63633","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63652","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-63633","title":"FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:00:52.23Z","modified":"2026-08-27T16:24:59.145Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-62672","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:00:52Z","modified":"2026-08-27T16:24:59Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"nvd":[{"id":"CVE-2026-63633","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:17:10.017Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-63633","title":"FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:00:52.23Z","modified":"2026-10-28T11:17:07.520728139Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-63633","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:17:10.017Z","modified":"2026-10-27T10:01:37.22039685Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"RHSA-2026:61378","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2026-09-01T10:28:23Z","modified":"2026-09-30T10:14:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:68706","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2026-09-18T10:15:35Z","modified":"2026-09-30T10:16:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:61378","title":"Important: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)\n\n* FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n\n* FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n\n* FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n\n* FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)\n\n* FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)\n\n* FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)\n\n* FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)\n\n* FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)\n\n* FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)\n\n* FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n\n* freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)\n\n* FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T12:09:07.14364Z","modified":"2026-09-01T12:30:02.534855985Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-63633","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context-\u003ecommon.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.","status":"published","published":"2026-08-19T18:17:00Z","modified":"2026-09-25T17:45:25.567426686Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"ALSA-2026:61378","title":"Important: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  \n\nSecurity Fix(es):  \n\n  * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)\n  * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n  * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n  * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n  * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)\n  * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)\n  * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)\n  * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)\n  * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)\n  * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)\n  * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n  * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)\n  * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:48.596839661Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"openSUSE-SU-2026:11385-1","title":"freerdp-3.30.0-1.1 on GA media","description":"These are all security issues fixed in the freerdp-3.30.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:25.802342133Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}