SB2026022756 - SUSE update for freerdp2
Published: February 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-22855)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability exists due to a boundary error in smartcard_unpack_set_attrib_call() function. A remote attacker can trick the victim into connecting to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
2) Use-after-free (CVE-ID: CVE-2026-22857)
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists due to a use-after-free error in irp_thread_func() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-23533)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in clear_decompress_residual_data. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-23732)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Glyph_Alloc. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-23883)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in update_pointer_new. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-23884)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in gdi_set_bounds. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Use-after-free (CVE-ID: CVE-2026-24491)
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists due to a use-after-free error in video_timer() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
8) Use-after-free (CVE-ID: CVE-2026-24675)
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists due to a use-after-free error in urb_select_interface() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
9) Use-after-free (CVE-ID: CVE-2026-24676)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in audio_format_compatible() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
10) Heap-based buffer overflow (CVE-ID: CVE-2026-24679)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability exists due to a boundary error in urb_select_interface() function. A remote attacker can trick the victim into connecting to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
11) Use-after-free (CVE-ID: CVE-2026-24681)
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists due to a use-after-free error in urb_bulk_transfer_cb() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
12) Heap-based buffer overflow (CVE-ID: CVE-2026-24682)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in audio_formats_free() function. A remote attacker can trick the victim into connecting to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
13) Use-after-free (CVE-ID: CVE-2026-24683)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in ainput_send_input_event() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
14) Use-after-free (CVE-ID: CVE-2026-24684)
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists due to a use-after-free error in play_thread() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.
Remediation
Install update from vendor's website.