Security update for freerdp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0763-1 Final 1 1 2026-03-03T12:49:14Z current 2026-03-03T12:49:14Z 2026-03-03T12:49:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freerdp This update for freerdp fixes the following issues: - CVE-2026-24491: heap-use-after-free in video_timer (bsc#1257981). - CVE-2026-24675: heap-use-after-free in urb_select_interface (bsc#1257982). - CVE-2026-24676: heap-use-after-free in audio_format_compatible (bsc#1257983). - CVE-2026-24677: heap-buffer-overflow in ecam_encoder_compress_h264 (bsc#1257984). - CVE-2026-24678: heap-use-after-free in cam_v4l_stream_capture_thread (bsc#1257985). - CVE-2026-24679: heap-buffer-overflow in urb_select_interface (bsc#1257986). - CVE-2026-24680: heap-use-after-free in update_pointer_new(SDL) (bsc#1257987). - CVE-2026-24681: heap-use-after-free in urb_bulk_transfer_cb (bsc#1257988). - CVE-2026-24682: heap-buffer-overflow in audio_formats_free (bsc#1257989). - CVE-2026-24683: heap-use-after-free in ainput_send_input_event (bsc#1257990). - CVE-2026-24684: heap-use-after-free in play_thread (bsc#1257991). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2026-763,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-763,SUSE-SLE-Product-WE-15-SP7-2026-763 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ Link for SUSE-SU-2026:0763-1 https://lists.suse.com/pipermail/sle-security-updates/2026-March/024553.html E-Mail link for SUSE-SU-2026:0763-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1257981 SUSE Bug 1257981 https://bugzilla.suse.com/1257982 SUSE Bug 1257982 https://bugzilla.suse.com/1257983 SUSE Bug 1257983 https://bugzilla.suse.com/1257984 SUSE Bug 1257984 https://bugzilla.suse.com/1257985 SUSE Bug 1257985 https://bugzilla.suse.com/1257986 SUSE Bug 1257986 https://bugzilla.suse.com/1257987 SUSE Bug 1257987 https://bugzilla.suse.com/1257988 SUSE Bug 1257988 https://bugzilla.suse.com/1257989 SUSE Bug 1257989 https://bugzilla.suse.com/1257990 SUSE Bug 1257990 https://bugzilla.suse.com/1257991 SUSE Bug 1257991 https://www.suse.com/security/cve/CVE-2026-24491/ SUSE CVE CVE-2026-24491 page https://www.suse.com/security/cve/CVE-2026-24675/ SUSE CVE CVE-2026-24675 page https://www.suse.com/security/cve/CVE-2026-24676/ SUSE CVE CVE-2026-24676 page https://www.suse.com/security/cve/CVE-2026-24677/ SUSE CVE CVE-2026-24677 page https://www.suse.com/security/cve/CVE-2026-24678/ SUSE CVE CVE-2026-24678 page https://www.suse.com/security/cve/CVE-2026-24679/ SUSE CVE CVE-2026-24679 page https://www.suse.com/security/cve/CVE-2026-24680/ SUSE CVE CVE-2026-24680 page https://www.suse.com/security/cve/CVE-2026-24681/ SUSE CVE CVE-2026-24681 page https://www.suse.com/security/cve/CVE-2026-24682/ SUSE CVE CVE-2026-24682 page https://www.suse.com/security/cve/CVE-2026-24683/ SUSE CVE CVE-2026-24683 page https://www.suse.com/security/cve/CVE-2026-24684/ SUSE CVE CVE-2026-24684 page SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-3.10.3-150700.3.6.1 freerdp-devel-3.10.3-150700.3.6.1 freerdp-proxy-3.10.3-150700.3.6.1 freerdp-proxy-plugins-3.10.3-150700.3.6.1 freerdp-sdl-3.10.3-150700.3.6.1 freerdp-server-3.10.3-150700.3.6.1 freerdp-wayland-3.10.3-150700.3.6.1 libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 libfreerdp3-3-3.10.3-150700.3.6.1 librdtk0-0-3.10.3-150700.3.6.1 libuwac0-0-3.10.3-150700.3.6.1 libwinpr3-3-3.10.3-150700.3.6.1 rdtk0-devel-3.10.3-150700.3.6.1 uwac0-devel-3.10.3-150700.3.6.1 winpr-devel-3.10.3-150700.3.6.1 freerdp-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 freerdp-devel-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 freerdp-proxy-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 freerdp-server-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 freerdp-wayland-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 libuwac0-0-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 freerdp-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-devel-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-proxy-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-proxy-plugins-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-sdl-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 freerdp-server-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 libfreerdp3-3-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 librdtk0-0-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 libwinpr3-3-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 winpr-devel-3.10.3-150700.3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0. CVE-2026-24491 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24491.html CVE-2026-24491 https://bugzilla.suse.com/1257981 SUSE Bug 1257981 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. CVE-2026-24675 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24675.html CVE-2026-24675 https://bugzilla.suse.com/1257982 SUSE Bug 1257982 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0. CVE-2026-24676 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24676.html CVE-2026-24676 https://bugzilla.suse.com/1257983 SUSE Bug 1257983 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. This vulnerability is fixed in 3.22.0. CVE-2026-24677 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24677.html CVE-2026-24677 https://bugzilla.suse.com/1257984 SUSE Bug 1257984 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fixed in 3.22.0. CVE-2026-24678 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24678.html CVE-2026-24678 https://bugzilla.suse.com/1257985 SUSE Bug 1257985 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. CVE-2026-24679 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24679.html CVE-2026-24679 https://bugzilla.suse.com/1257986 SUSE Bug 1257986 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0. CVE-2026-24680 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24680.html CVE-2026-24680 https://bugzilla.suse.com/1257987 SUSE Bug 1257987 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0. CVE-2026-24681 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24681.html CVE-2026-24681 https://bugzilla.suse.com/1257988 SUSE Bug 1257988 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0. CVE-2026-24682 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24682.html CVE-2026-24682 https://bugzilla.suse.com/1257989 SUSE Bug 1257989 FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0. CVE-2026-24683 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24683.html CVE-2026-24683 https://bugzilla.suse.com/1257990 SUSE Bug 1257990 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0. CVE-2026-24684 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:freerdp-wayland-3.10.3-150700.3.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:libuwac0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-devel-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-proxy-plugins-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-sdl-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:freerdp-server-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp-server-proxy3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libfreerdp3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:librdtk0-0-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:libwinpr3-3-3.10.3-150700.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP7:winpr-devel-3.10.3-150700.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260763-1/ https://www.suse.com/security/cve/CVE-2026-24684.html CVE-2026-24684 https://bugzilla.suse.com/1257991 SUSE Bug 1257991