The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0140 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-26965:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE     planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) +     (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that     `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes     `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by     `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with     attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to     132,096 bytes past the temp buffer end, and  on the brk heap (desktop  128128), an adjacent     `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data     control-flowrelevant corruption (function pointer overwritten) demonstrated under deterministic heap     layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.

    CVE-2026-26955:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP     server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g.,     `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle.
    The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command     rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top`     (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without     bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with     attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function     pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command  full instruction     pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to     receive a patch.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5936 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:5939 advisory.

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)
      * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1485 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP     server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g.,     `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle.
    The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command     rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top`     (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without     bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with     attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function     pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command -- full instruction     pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to     receive a patch. (CVE-2026-26955)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE     planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) +     (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that     `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes     `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by     `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with     attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to     132,096 bytes past the temp buffer end, and on the brk heap (desktop <= 128x128), an adjacent     `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data --     control-flow-relevant corruption (function pointer overwritten) demonstrated under deterministic heap     layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability. (CVE-2026-26965)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6384 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6665 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007105 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP     server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g.,     `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle.
    The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command     rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top`     (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without     bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with     attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function     pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command  full instruction     pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to     receive a patch.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6005 advisory.

    * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path     (CVE-2026-26965)

    * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline     (CVE-2026-26955)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c0deda1e7 advisory.

    Automatic update for freerdp2-2.11.7-16.fc46.

    ##### **Changelog**

    ```
    * Mon Aug 31 2026 Ondrej Holy <oholy@redhat.com> - 2.11.7-16
    - Backport several CVE fixes (CVE-2026-22852, CVE-2026-22854, CVE-2026-22855,       CVE-2026-22856, CVE-2026-22858, CVE-2026-22859, CVE-2026-23530,       CVE-2026-23531, CVE-2026-23532, CVE-2026-23533, CVE-2026-23534,       CVE-2026-23732, CVE-2026-23883, CVE-2026-23884, CVE-2026-23948,       CVE-2026-24491, CVE-2026-24675, CVE-2026-24676, CVE-2026-24679,       CVE-2026-24681, CVE-2026-24683, CVE-2026-24684, CVE-2026-25952,       CVE-2026-26955, CVE-2026-26965, CVE-2026-26986, CVE-2026-27951,       CVE-2026-29775, CVE-2026-31806, CVE-2026-31883, CVE-2026-31884,       CVE-2026-31885, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985,       CVE-2026-45700, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299 and       CVE-2026-68580)       Resolves: rhbz#2430919, rhbz#2430908, rhbz#2430898, rhbz#2430914, rhbz#2430903       Resolves: rhbz#2430924, rhbz#2430933, rhbz#2429808, rhbz#2429823, rhbz#2429794       Resolves: rhbz#2443146, rhbz#2442975, rhbz#2429799, rhbz#2429814, rhbz#2429821       Resolves: rhbz#2438309, rhbz#2438321, rhbz#2438308, rhbz#2438328, rhbz#2438324       Resolves: rhbz#2438302, rhbz#2438310, rhbz#2438300, rhbz#2447394, rhbz#2453243       Resolves: rhbz#2453240, rhbz#2442837, rhbz#2442810, rhbz#2447426, rhbz#2447422       Resolves: rhbz#2447413, rhbz#2447416, rhbz#2453247, rhbz#2442857, rhbz#2491683       Resolves: rhbz#2510295, rhbz#2510643, rhbz#2503646, rhbz#2510448

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
302079	TencentOS Server 4: freerdp (TSSA-2026:0140)	Nessus	Tencent Local Security Checks	2026/3/13	2026/4/30	high
303812	RHEL 10 : freerdp (RHSA-2026:5936)	Nessus	Red Hat Local Security Checks	2026/3/26	2026/4/30	high
304010	AlmaLinux 10 : freerdp (ALSA-2026:5939)	Nessus	Alma Linux Local Security Checks	2026/3/27	2026/3/27	high
304281	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1485)	Nessus	Amazon Linux Local Security Checks	2026/3/30	2026/4/30	high
304543	RHEL 9 : freerdp (RHSA-2026:6384)	Nessus	Red Hat Local Security Checks	2026/4/1	2026/4/1	high
305079	RHEL 8 : freerdp (RHSA-2026:6665)	Nessus	Red Hat Local Security Checks	2026/4/6	2026/4/6	high
305970	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-007105)	Nessus	Unity Linux Local Security Checks	2026/4/10	2026/4/10	high
357175	Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_6005)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
342220	Fedora 46 : freerdp2 (2026-1c0deda1e7)	Nessus	Fedora Local Security Checks	2026/9/1	2026/9/1	critical

検出

プラグインの検索

high

high

high

high

high

high

high

high

critical