SB2026102943 - openEuler 24.03 LTS SP1 update for freerdp
Published: October 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-91953)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in nego_send_negotiation_request when processing an oversized LB_LOAD_BALANCE_INFO routing token during connection negotiation. A remote attacker can send a crafted Server Redirection PDU to cause a denial of service.
The issue is reachable before any security protocol handshake completes, and user interaction is required to connect to a malicious server or a machine-in-the-middle server.
2) Out-of-bounds read (CVE-ID: CVE-2026-91956)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in func_get_ep_desc() in the URBDRC channel when processing a crafted SELECT_CONFIGURATION descriptor followed by a bulk or interrupt transfer request. A remote attacker can send a crafted RDP server response to cause a denial of service.
Exploitation is reachable on clients with USB redirection enabled and relies on an InterfaceNumber-to-array-position mismatch together with an unchecked AlternateSetting index.
3) Reachable assertion (CVE-ID: CVE-2026-91959)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to reachable assertion in rts_read_result() in libfreerdp/core/gateway/rts.c when parsing a truncated BIND_ACK result list sent by an RD Gateway over the RPC-over-HTTP transport. A remote attacker can send a specially crafted BIND_ACK fragment to cause a denial of service.
User interaction is required to induce the victim to connect through an attacker-controlled gateway, such as via a crafted .rdp file or link.
4) Use of uninitialized resource (CVE-ID: CVE-2026-91963)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of uninitialized resource in the urbdrc USB redirection path when handling failed or short USB control transfer IN completions. A remote attacker can issue crafted IN transfers through a malicious RDP server to disclose sensitive information.
USB redirection must be active and a USB device must be redirected for exploitation to succeed.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-91964)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in nego_send_negotiation_request when processing a server-controlled RoutingToken during RDP negotiation after redirection. A remote attacker can send a specially crafted server redirection PDU to execute arbitrary code.
Without chaining with a separate memory leak to defeat ASLR, the issue results in a client crash. User interaction is required because the victim must connect to a malicious RDP server.
Remediation
Install update from vendor's website.