SB20260408156 - SUSE update for freerdp2
Published: April 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Buffer Over-read (CVE-ID: CVE-2026-26271)
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to buffer over-read in freerdp_image_copy_from_icon_data() when processing crafted RDP window icon data. A remote attacker can send specially crafted icon data to disclose sensitive information.
The issue is reachable over the network when a client processes icon data from an RDP server or a man-in-the-middle position.
2) Out-of-bounds write (CVE-ID: CVE-2026-26955)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in gdi_SurfaceCommand_ClearCodec() when processing an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. A remote attacker can send a specially crafted RDP server response to execute arbitrary code.
User interaction is required because the victim must connect to a malicious RDP server.
3) Out-of-bounds write (CVE-ID: CVE-2026-26965)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in planar_decompress_plane_rle() in the PLANAR RLE decode path when processing a crafted RDP planar bitmap in the temp-buffer path. A remote attacker can send a specially crafted RDP server response to execute arbitrary code.
User interaction is required because the victim must connect to a malicious RDP server.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-31806)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in nsc_process_message() when processing SURFACE_BITS_COMMAND messages using NSCodec. A remote attacker can send a specially crafted RDP server message with oversized bitmap dimensions to execute arbitrary code.
The issue can be triggered when a FreeRDP client connects to a malicious RDP server.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-31883)
The vulnerability allows a remote attacker to overwrite heap memory.
The vulnerability exists due to a heap-based buffer overflow in the IMA-ADPCM and MS-ADPCM audio decoders in libfreerdp/codec/dsp.c when processing crafted RDPSND audio format and wave data. A remote attacker can send specially crafted RDPSND audio data to overwrite heap memory.
Audio data is processed automatically during an RDP session when RDPSND is negotiated.
6) Out-of-bounds read (CVE-ID: CVE-2026-31885)
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the MS-ADPCM and IMA-ADPCM decoders in dsp.c when processing crafted ADPCM audio data over the RDPSND channel. A remote attacker can send specially crafted audio data to disclose sensitive information.
User interaction is required.
Remediation
Install update from vendor's website.