Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
An update that solves 15 vulnerabilities and has one security fix can now be installed.. # Security update for freerdp2 Announcement ID: SUSE-SU-2026:1640-1 Release Date: 2026-04-28T11:33:59Z Rating: important References: * bsc#1258919 * bsc#1258920 * bsc#1258921 * bsc#1258923 * bsc#1258924 * bsc#1258939 * bsc#1258967 * bsc#1258977 * bsc#1258987 * bsc#1259653 * bsc#1259680 * bsc#1259684 * bsc#1259689 * bsc#1259692 * bsc#1259693 * bsc#1261848 Cross-References: * CVE-2026-25941 * CVE-2026-25942 * CVE-2026-25952 * CVE-2026-25953 * CVE-2026-25954 * CVE-2026-25997 * CVE-2026-26986 * CVE-2026-27015 * CVE-2026-27951 * CVE-2026-29774 * CVE-2026-29775 * CVE-2026-29776 * CVE-2026-31806 * CVE-2026-31884 * CVE-2026-31897 CVSS scores: * CVE-2026-25941 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-25941 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-25941 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H * CVE-2026-25941 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-25942 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25942 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25942 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-25942 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25952 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25952 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25952 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-25952 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-25953 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25953 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25953 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-25953 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-25954 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25954 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25954 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-25954 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25997 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25997 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-25997 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-25997 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-26986 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-26986 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-26986 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-26986 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-27015 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N *CVE-2026-27015 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-27015 ( NVD ): 5.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-27015 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-27951 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-27951 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-27951 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-27951 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-29774 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-29774 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-29774 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-29774 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H * CVE-2026-29775 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-29775 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-29775 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-29775 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H * CVE-2026-29776 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-29776 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-29776 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-31806 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-31806 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-31806 ( NVD ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-31806( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-31884 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-31884 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-31884 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-31884 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-31897 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-31897 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-31897 ( NVD ): 0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N * CVE-2026-31897 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Linux Enterprise Workstation Extension 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves 15 vulnerabilities and has one security fix can now be installed. ## Description: This update for freerdp2 fixes the following issues: * CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU (bsc#1258919). * CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920). * CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921). * CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923). * CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924). * CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977). * CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967). * CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987). * CVE-2026-27951: Denial of Service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939). * CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689). * CVE-2026-29775: Malicious server can trigger a client-side heap out-of- bounds access (bsc#1259684). * CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692). * CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1640=1 * SUSE Linux Enterprise Workstation Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-1640=1 ## Package List: * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * freerdp2-debugsource-2.11.7-150700.3.22.1 * winpr2-devel-2.11.7-150700.3.22.1 * freerdp2-debuginfo-2.11.7-150700.3.22.1 * SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64) * freerdp2-proxy-debuginfo-2.11.7-150700.3.22.1 * winpr2-devel-2.11.7-150700.3.22.1 * freerdp2-server-2.11.7-150700.3.22.1 * freerdp2-server-debuginfo-2.11.7-150700.3.22.1 * freerdp2-2.11.7-150700.3.22.1 * freerdp2-devel-2.11.7-150700.3.22.1 * libwinpr2-2-debuginfo-2.11.7-150700.3.22.1 * freerdp2-debugsource-2.11.7-150700.3.22.1 * libfreerdp2-2-2.11.7-150700.3.22.1 * libwinpr2-2-2.11.7-150700.3.22.1 * freerdp2-debuginfo-2.11.7-150700.3.22.1 * freerdp2-proxy-2.11.7-150700.3.22.1 * libfreerdp2-2-debuginfo-2.11.7-150700.3.22.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25941.html * https://www.suse.com/security/cve/CVE-2026-25942.html * https://www.suse.com/security/cve/CVE-2026-25952.html * https://www.suse.com/security/cve/CVE-2026-25953.html * https://www.suse.com/security/cve/CVE-2026-25954.html * https://www.suse.com/security/cve/CVE-2026-25997.html * https://www.suse.com/security/cve/CVE-2026-26986.html * https://www.suse.com/security/cve/CVE-2026-27015.html * https://www.suse.com/security/cve/CVE-2026-27951.html * https://www.suse.com/security/cve/CVE-2026-29774.html * https://www.suse.com/security/cve/CVE-2026-29775.html * https://www.suse.com/security/cve/CVE-2026-29776.html * https://www.suse.com/security/cve/CVE-2026-31806.html * https://www.suse.com/security/cve/CVE-2026-31884.html * https://www.suse.com/security/cve/CVE-2026-31897.html * https://bugzilla.suse.com/show_bug.cgi?id=1258919 * https://bugzilla.suse.com/show_bug.cgi?id=1258920 * https://bugzilla.suse.com/show_bug.cgi?id=1258921 * https://bugzilla.suse.com/show_bug.cgi?id=1258923 * https://bugzilla.suse.com/show_bug.cgi?id=1258924 * https://bugzilla.suse.com/show_bug.cgi?id=1258939 * https://bugzilla.suse.com/show_bug.cgi?id=1258967 * https://bugzilla.suse.com/show_bug.cgi?id=1258977 * https://bugzilla.suse.com/show_bug.cgi?id=1258987 * https://bugzilla.suse.com/show_bug.cgi?id=1259653 * https://bugzilla.suse.com/show_bug.cgi?id=1259680 * https://bugzilla.suse.com/show_bug.cgi?id=1259684 * https://bugzilla.suse.com/show_bug.cgi?id=1259689 * https://bugzilla.suse.com/show_bug.cgi?id=1259692 * https://bugzilla.suse.com/show_bug.cgi?id=1259693 * https://bugzilla.suse.com/show_bug.cgi?id=1261848 . Critical update for freerdp2 on SUSE fixes multiple issues, including Denial of Service and buffer overflow risks. Install soon.. freerdp2 security patch, SUSE security update, important freerdp2 advisory, Linux vulnerabilities. . Severity: Important. LinuxSecurity.com Team
An update that solves 8 vulnerabilities can now be installed.. # freerdp2-2.11.7-8.1 on GA media Announcement ID: openSUSE-SU-2026:10611-1 Rating: moderate Cross-References: * CVE-2026-25941 * CVE-2026-25942 * CVE-2026-25952 * CVE-2026-25954 * CVE-2026-25997 * CVE-2026-26986 * CVE-2026-27015 * CVE-2026-27951 CVSS scores: * CVE-2026-25941 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-25941 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-25942 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25942 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25952 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25952 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25954 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-25954 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25997 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-25997 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-26986 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-26986 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-27015 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-27015 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-27951 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-27951 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 8 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the freerdp2-2.11.7-8.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * freerdp22.11.7-8.1 * freerdp2-devel 2.11.7-8.1 * freerdp2-proxy 2.11.7-8.1 * freerdp2-server 2.11.7-8.1 * libfreerdp2-2 2.11.7-8.1 * libwinpr2-2 2.11.7-8.1 * winpr2-devel 2.11.7-8.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25941.html * https://www.suse.com/security/cve/CVE-2026-25942.html * https://www.suse.com/security/cve/CVE-2026-25952.html * https://www.suse.com/security/cve/CVE-2026-25954.html * https://www.suse.com/security/cve/CVE-2026-25997.html * https://www.suse.com/security/cve/CVE-2026-26986.html * https://www.suse.com/security/cve/CVE-2026-27015.html * https://www.suse.com/security/cve/CVE-2026-27951.html . Eight vulnerabilities have been resolved in freerdp2-2.11.7-8.1 for openSUSE Tumbleweed with moderate severity.. openSUSE freerdp2 vulnerabilities security update. . LinuxSecurity.com Team
An update that solves one vulnerability can now be installed.. # Security update for freerdp2 Announcement ID: SUSE-SU-2026:1313-1 Release Date: 2026-04-14T10:47:32Z Rating: important References: * bsc#1257991 Cross-References: * CVE-2026-24684 CVSS scores: * CVE-2026-24684 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24684 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24684 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24684 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Linux Enterprise Workstation Extension 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves one vulnerability can now be installed. ## Description: This update for freerdp2 fixes the following issues: * Fix the CVE-2026-24684 patch, as the previous version wrongly deleted a check for an error condition (bsc#1257991). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1313=1 * SUSE Linux Enterprise Workstation Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-1313=1 ## Package List: * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * winpr2-devel-2.11.7-150700.3.17.1 * freerdp2-debuginfo-2.11.7-150700.3.17.1 * freerdp2-debugsource-2.11.7-150700.3.17.1 * SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64) *libfreerdp2-2-debuginfo-2.11.7-150700.3.17.1 * libwinpr2-2-2.11.7-150700.3.17.1 * freerdp2-proxy-debuginfo-2.11.7-150700.3.17.1 * freerdp2-2.11.7-150700.3.17.1 * freerdp2-debuginfo-2.11.7-150700.3.17.1 * freerdp2-server-2.11.7-150700.3.17.1 * libfreerdp2-2-2.11.7-150700.3.17.1 * freerdp2-server-debuginfo-2.11.7-150700.3.17.1 * winpr2-devel-2.11.7-150700.3.17.1 * libwinpr2-2-debuginfo-2.11.7-150700.3.17.1 * freerdp2-debugsource-2.11.7-150700.3.17.1 * freerdp2-devel-2.11.7-150700.3.17.1 * freerdp2-proxy-2.11.7-150700.3.17.1 ## References: * https://www.suse.com/security/cve/CVE-2026-24684.html * https://bugzilla.suse.com/show_bug.cgi?id=1257991 . Important update for freerdp2 to address CVE-2026-24684 on SUSE systems and enhance security measures for users and applications affected. freerdp2 security update, SUSE Linux Enterprise, CVE-2026-24684, important patch, access control issue. . Severity: Important. LinuxSecurity.com Team
An update that solves six vulnerabilities can now be installed.. # Security update for freerdp2 Announcement ID: SUSE-SU-2026:1164-1 Release Date: 2026-04-01T13:40:49Z Rating: important References: * bsc#1258979 * bsc#1258982 * bsc#1258985 * bsc#1259653 * bsc#1259679 * bsc#1259686 Cross-References: * CVE-2026-26271 * CVE-2026-26955 * CVE-2026-26965 * CVE-2026-31806 * CVE-2026-31883 * CVE-2026-31885 CVSS scores: * CVE-2026-26271 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-26271 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-26955 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-26955 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-26955 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-26965 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-26965 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-26965 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-31806 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-31806 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-31806 ( NVD ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-31806 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-31883 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-31883 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-31883 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-31883 ( NVD ): 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-31885 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-31885 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2026-31885 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-31885 ( NVD ): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H Affected Products: * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Linux Enterprise Workstation Extension 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves six vulnerabilities can now be installed. ## Description: This update for freerdp2 fixes the following issues: * CVE-2026-26271: Buffer Overread in FreeRDP Icon Processing (bsc#1258979). * CVE-2026-26955: Out-of-bounds Write in freerdp (bsc#1258982). * CVE-2026-26965: Out-of-bounds Write in freerdp (bsc#1258985). * CVE-2026-31806: improper validation of server messages can lead to a heap buffer overflow and arbitrary code execution (bsc#1259653). * CVE-2026-31883: crafted RDPSND audio format and wave data can cause a heap buffer overflow write (bsc#1259679). * CVE-2026-31885: unchecked predictor can lead to an out-of-bounds read (bsc#1259686). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1164=1 * SUSE Linux Enterprise Workstation Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-1164=1 ## Package List: * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * freerdp2-debuginfo-2.11.7-150700.3.14.1 * winpr2-devel-2.11.7-150700.3.14.1 * freerdp2-debugsource-2.11.7-150700.3.14.1 * SUSELinux Enterprise Workstation Extension 15 SP7 (x86_64) * freerdp2-debuginfo-2.11.7-150700.3.14.1 * freerdp2-devel-2.11.7-150700.3.14.1 * libwinpr2-2-2.11.7-150700.3.14.1 * freerdp2-server-debuginfo-2.11.7-150700.3.14.1 * freerdp2-debugsource-2.11.7-150700.3.14.1 * libfreerdp2-2-2.11.7-150700.3.14.1 * winpr2-devel-2.11.7-150700.3.14.1 * freerdp2-2.11.7-150700.3.14.1 * libfreerdp2-2-debuginfo-2.11.7-150700.3.14.1 * freerdp2-proxy-debuginfo-2.11.7-150700.3.14.1 * freerdp2-server-2.11.7-150700.3.14.1 * libwinpr2-2-debuginfo-2.11.7-150700.3.14.1 * freerdp2-proxy-2.11.7-150700.3.14.1 ## References: * https://www.suse.com/security/cve/CVE-2026-26271.html * https://www.suse.com/security/cve/CVE-2026-26955.html * https://www.suse.com/security/cve/CVE-2026-26965.html * https://www.suse.com/security/cve/CVE-2026-31806.html * https://www.suse.com/security/cve/CVE-2026-31883.html * https://www.suse.com/security/cve/CVE-2026-31885.html * https://bugzilla.suse.com/show_bug.cgi?id=1258979 * https://bugzilla.suse.com/show_bug.cgi?id=1258982 * https://bugzilla.suse.com/show_bug.cgi?id=1258985 * https://bugzilla.suse.com/show_bug.cgi?id=1259653 * https://bugzilla.suse.com/show_bug.cgi?id=1259679 * https://bugzilla.suse.com/show_bug.cgi?id=1259686 . Critical update available for freerdp2 resolves multiple important vulnerabilities related to buffer overflows and memory errors.. freerdp2 update, important security fix, SUSE vulnerabilities, buffer overflows, heap overflows. . Severity: Important. LinuxSecurity.com Team
An update that solves 12 vulnerabilities can now be installed.. # freerdp2-2.11.7-6.1 on GA media Announcement ID: openSUSE-SU-2026:10459-1 Rating: moderate Cross-References: * CVE-2026-22855 * CVE-2026-22857 * CVE-2026-23533 * CVE-2026-23732 * CVE-2026-23883 * CVE-2026-23884 * CVE-2026-26271 * CVE-2026-26955 * CVE-2026-26965 * CVE-2026-31806 * CVE-2026-31883 * CVE-2026-31885 CVSS scores: * CVE-2026-22855 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H * CVE-2026-22855 ( SUSE ): 6.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-22857 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-22857 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23533 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23533 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23732 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-23732 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-23883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23884 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23884 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-26955 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-26955 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-26965 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-26965 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-31806 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-31806 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-31883 ( SUSE ): 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-31883 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-31885 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2026-31885 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 12 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the freerdp2-2.11.7-6.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * freerdp2 2.11.7-6.1 * freerdp2-devel 2.11.7-6.1 * freerdp2-proxy 2.11.7-6.1 * freerdp2-server 2.11.7-6.1 * libfreerdp2-2 2.11.7-6.1 * libwinpr2-2 2.11.7-6.1 * winpr2-devel 2.11.7-6.1 ## References: * https://www.suse.com/security/cve/CVE-2026-22855.html * https://www.suse.com/security/cve/CVE-2026-22857.html * https://www.suse.com/security/cve/CVE-2026-23533.html * https://www.suse.com/security/cve/CVE-2026-23732.html * https://www.suse.com/security/cve/CVE-2026-23883.html * https://www.suse.com/security/cve/CVE-2026-23884.html * https://www.suse.com/security/cve/CVE-2026-26271.html * https://www.suse.com/security/cve/CVE-2026-26955.html * https://www.suse.com/security/cve/CVE-2026-26965.html * https://www.suse.com/security/cve/CVE-2026-31806.html * https://www.suse.com/security/cve/CVE-2026-31883.html * https://www.suse.com/security/cve/CVE-2026-31885.html . Update for openSUSE Tumbleweed resolves 12 vulnerabilities in freerdp2, requires immediate action for users.. freerdp2 update, openSUSE vulnerabilities, security patch, system security update. . LinuxSecurity.com Team
An update that solves one vulnerability and has one security fix can now be installed.. # Security update for freerdp2 Announcement ID: SUSE-SU-2026:0968-1 Release Date: 2026-03-23T14:18:05Z Rating: important References: * bsc#1257981 * bsc#1259251 Cross-References: * CVE-2026-24491 CVSS scores: * CVE-2026-24491 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24491 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24491 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24491 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Linux Enterprise Workstation Extension 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for freerdp2 fixes the following issue: * CVE-2026-24491: Heap-use-after-free in video_timer additional fix (bsc#1257981). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Workstation Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-968=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-968=1 ## Package List: * SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64) * winpr2-devel-2.11.7-150700.3.11.1 * freerdp2-debuginfo-2.11.7-150700.3.11.1 * freerdp2-proxy-debuginfo-2.11.7-150700.3.11.1 *libwinpr2-2-debuginfo-2.11.7-150700.3.11.1 * libfreerdp2-2-2.11.7-150700.3.11.1 * libwinpr2-2-2.11.7-150700.3.11.1 * freerdp2-server-2.11.7-150700.3.11.1 * freerdp2-server-debuginfo-2.11.7-150700.3.11.1 * freerdp2-devel-2.11.7-150700.3.11.1 * freerdp2-2.11.7-150700.3.11.1 * freerdp2-debugsource-2.11.7-150700.3.11.1 * freerdp2-proxy-2.11.7-150700.3.11.1 * libfreerdp2-2-debuginfo-2.11.7-150700.3.11.1 * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * winpr2-devel-2.11.7-150700.3.11.1 * freerdp2-debuginfo-2.11.7-150700.3.11.1 * freerdp2-debugsource-2.11.7-150700.3.11.1 ## References: * https://www.suse.com/security/cve/CVE-2026-24491.html * https://bugzilla.suse.com/show_bug.cgi?id=1257981 * https://bugzilla.suse.com/show_bug.cgi?id=1259251 . Fixes in freerdp2 for CVE-2026-24491 available in SUSE update addressing an important security issue with heap memory.. freerdp2 security update, SUSE freerdp2 vulnerability, freerdp2 patch instructions, important freerdp2 update, heap use after free issue. . Severity: Important. LinuxSecurity.com Team
An update that solves 14 vulnerabilities can now be installed.. # Security update for freerdp2 Announcement ID: SUSE-SU-2026:0683-1 Release Date: 2026-02-27T10:42:32Z Rating: important References: * bsc#1256721 * bsc#1256723 * bsc#1256943 * bsc#1256945 * bsc#1256946 * bsc#1256947 * bsc#1257981 * bsc#1257982 * bsc#1257983 * bsc#1257986 * bsc#1257988 * bsc#1257989 * bsc#1257990 * bsc#1257991 Cross-References: * CVE-2026-22855 * CVE-2026-22857 * CVE-2026-23533 * CVE-2026-23732 * CVE-2026-23883 * CVE-2026-23884 * CVE-2026-24491 * CVE-2026-24675 * CVE-2026-24676 * CVE-2026-24679 * CVE-2026-24681 * CVE-2026-24682 * CVE-2026-24683 * CVE-2026-24684 CVSS scores: * CVE-2026-22855 ( SUSE ): 6.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-22855 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H * CVE-2026-22855 ( NVD ): 5.6 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-22855 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H * CVE-2026-22857 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-22857 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-22857 ( NVD ): 6.8 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-22857 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-23533 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23533 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23533 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-23533 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-23732 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-23732 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-23732 ( NVD ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-23732 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23883 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-23883 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-23884 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23884 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-23884 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-23884 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-24491 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24491 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24491 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24491 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24675 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24675 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24675 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24675 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24676 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24676 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24676 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24676 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24679 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24679 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24679 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24679 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H * CVE-2026-24681 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24681 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24681 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24681 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24682 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24682 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24682 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24682 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24683 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24683 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24683 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24683 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-24684 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24684 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24684 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-24684 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Linux Enterprise Workstation Extension 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves 14 vulnerabilities can now be installed. ##Description: This update for freerdp2 fixes the following issues: * CVE-2026-22855: heap-buffer-overflow in smartcard_unpack_set_attrib_call (bsc#1256721). * CVE-2026-22857: heap-use-after-free in irp_thread_func (bsc#1256723). * CVE-2026-23533: improper validation can lead to heap buffer overflow in `clear_decompress_residual_data` (bsc#1256943). * CVE-2026-23732: improper validation can lead to heap buffer overflow in `Glyph_Alloc` (bsc#1256945). * CVE-2026-23883: use-after-free when `update_pointer_color` and `freerdp_image_copy_from_pointer_data` fail (bsc#1256946). * CVE-2026-23884: use-after-free in `gdi_set_bounds` (bsc#1256947). * CVE-2026-24491: heap-use-after-free in video_timer (bsc#1257981). * CVE-2026-24675: heap-use-after-free in urb_select_interface (bsc#1257982). * CVE-2026-24676: heap-use-after-free in audio_format_compatible (bsc#1257983). * CVE-2026-24679: heap-buffer-overflow in urb_select_interface (bsc#1257986). * CVE-2026-24681: heap-use-after-free in urb_bulk_transfer_cb (bsc#1257988). * CVE-2026-24682: heap-buffer-overflow in audio_formats_free (bsc#1257989). * CVE-2026-24683: heap-use-after-free in ainput_send_input_event (bsc#1257990). * CVE-2026-24684: heap-use-after-free in play_thread (bsc#1257991). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-683=1 * SUSE Linux Enterprise Workstation Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-683=1 ## Package List: * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * freerdp2-debuginfo-2.11.7-150700.3.8.1 * winpr2-devel-2.11.7-150700.3.8.1 * freerdp2-debugsource-2.11.7-150700.3.8.1 * SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64) *libfreerdp2-2-2.11.7-150700.3.8.1 * libwinpr2-2-2.11.7-150700.3.8.1 * freerdp2-server-debuginfo-2.11.7-150700.3.8.1 * freerdp2-proxy-2.11.7-150700.3.8.1 * freerdp2-server-2.11.7-150700.3.8.1 * freerdp2-2.11.7-150700.3.8.1 * freerdp2-devel-2.11.7-150700.3.8.1 * freerdp2-debugsource-2.11.7-150700.3.8.1 * libwinpr2-2-debuginfo-2.11.7-150700.3.8.1 * libfreerdp2-2-debuginfo-2.11.7-150700.3.8.1 * winpr2-devel-2.11.7-150700.3.8.1 * freerdp2-debuginfo-2.11.7-150700.3.8.1 * freerdp2-proxy-debuginfo-2.11.7-150700.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2026-22855.html * https://www.suse.com/security/cve/CVE-2026-22857.html * https://www.suse.com/security/cve/CVE-2026-23533.html * https://www.suse.com/security/cve/CVE-2026-23732.html * https://www.suse.com/security/cve/CVE-2026-23883.html * https://www.suse.com/security/cve/CVE-2026-23884.html * https://www.suse.com/security/cve/CVE-2026-24491.html * https://www.suse.com/security/cve/CVE-2026-24675.html * https://www.suse.com/security/cve/CVE-2026-24676.html * https://www.suse.com/security/cve/CVE-2026-24679.html * https://www.suse.com/security/cve/CVE-2026-24681.html * https://www.suse.com/security/cve/CVE-2026-24682.html * https://www.suse.com/security/cve/CVE-2026-24683.html * https://www.suse.com/security/cve/CVE-2026-24684.html * https://bugzilla.suse.com/show_bug.cgi?id=1256721 * https://bugzilla.suse.com/show_bug.cgi?id=1256723 * https://bugzilla.suse.com/show_bug.cgi?id=1256943 * https://bugzilla.suse.com/show_bug.cgi?id=1256945 * https://bugzilla.suse.com/show_bug.cgi?id=1256946 * https://bugzilla.suse.com/show_bug.cgi?id=1256947 * https://bugzilla.suse.com/show_bug.cgi?id=1257981 * https://bugzilla.suse.com/show_bug.cgi?id=1257982 * https://bugzilla.suse.com/show_bug.cgi?id=1257983 * https://bugzilla.suse.com/show_bug.cgi?id=1257986 * https://bugzilla.suse.com/show_bug.cgi?id=1257988 * https://bugzilla.suse.com/show_bug.cgi?id=1257989 *https://bugzilla.suse.com/show_bug.cgi?id=1257990 * https://bugzilla.suse.com/show_bug.cgi?id=1257991 . An important update addresses multiple vulnerabilities in freerdp2 on SUSE systems. Immediate installation recommended.. freerdp2 vulnerabilities important SUSE update. . Severity: Important. LinuxSecurity.com Team
An update that solves 8 vulnerabilities can now be installed.. # freerdp2-2.11.7-5.1 on GA media Announcement ID: openSUSE-SU-2026:10243-1 Rating: moderate Cross-References: * CVE-2026-24491 * CVE-2026-24675 * CVE-2026-24676 * CVE-2026-24679 * CVE-2026-24681 * CVE-2026-24682 * CVE-2026-24683 * CVE-2026-24684 CVSS scores: * CVE-2026-24491 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24491 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24675 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24675 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24676 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24676 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24679 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24679 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24681 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24681 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24682 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24682 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24683 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24683 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-24684 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-24684 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 8 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the freerdp2-2.11.7-5.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * freerdp22.11.7-5.1 * freerdp2-devel 2.11.7-5.1 * freerdp2-proxy 2.11.7-5.1 * freerdp2-server 2.11.7-5.1 * libfreerdp2-2 2.11.7-5.1 * libwinpr2-2 2.11.7-5.1 * winpr2-devel 2.11.7-5.1 ## References: * https://www.suse.com/security/cve/CVE-2026-24491.html * https://www.suse.com/security/cve/CVE-2026-24675.html * https://www.suse.com/security/cve/CVE-2026-24676.html * https://www.suse.com/security/cve/CVE-2026-24679.html * https://www.suse.com/security/cve/CVE-2026-24681.html * https://www.suse.com/security/cve/CVE-2026-24682.html * https://www.suse.com/security/cve/CVE-2026-24683.html * https://www.suse.com/security/cve/CVE-2026-24684.html . An openSUSE update for freerdp2 resolves 8 moderate issues. Important security fixes are available now.. openSUSE freerdp2 security fixes update advisory. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.