Back Linuxsecurity

openSUSE Security Update freerdp Important 6 Issues Fixed 2026-1160

Linuxsecurity •LinuxSecurity Advisories • March 31, 2026

This update for freerdp fixes the following issues: * CVE-2026-26271: Buffer Overread in FreeRDP Icon Processing (bsc#1258979). * CVE-2026-26955: Out-of-bounds Write in freerdp (bsc#1258982). * CVE-2026-26965: Out-of-bounds Write in freerdp (bsc#1258985). * CVE-2026-31806: improper validation of server messages can lead to a heap buffer overflow and arbitrary code execution (bsc#1259653). * CVE-2026-31883: crafted RDPSND audio format and wave data can cause a heap buffer overflow write (bsc#1259679). * CVE-2026-31885: unchecked predictor can lead to an out-of-bounds read (bsc#1259686).

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-1160=1 openSUSE-SLE-15.6-2026-1160=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1160=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-2026-1160=1 openSUSE-SLE-15.6-2026-1160=1

* SUSE Package Hub 15 15-SP7

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1160=1

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * freerdp-proxy-2.11.2-150600.4.18.1 * freerdp-devel-2.11.2-150600.4.18.1 * freerdp-server-debuginfo-2.11.2-150600.4.18.1 * freerdp-wayland-2.11.2-150600.4.18.1 * uwac0-0-devel-2.11.2-150600.4.18.1 * freerdp-wayland-debuginfo-2.11.2-150600.4.18.1 * libwinpr2-2-2.11.2-150600.4.18.1 * libwinpr2-2-debuginfo-2.11.2-150600.4.18.1 * libuwac0-0-2.11.2-150600.4.18.1 * freerdp-proxy-debuginfo-2.11.2-150600.4.18.1 * winpr-devel-2.11.2-150600.4.18.1 * libuwac0-0-debuginfo-2.11.2-150600.4.18.1 * freerdp-debuginfo-2.11.2-150600.4.18.1 * freerdp-debugsource-2.11.2-150600.4.18.1 * libfreerdp2-2-2.11.2-150600.4.18.1 * freerdp-2.11.2-150600.4.18.1 * freerdp-server-2.11.2-150600.4.18.1 * libfreerdp2-2-debuginfo-2.11.2-150600.4.18.1 * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x) * uwac0-0-devel-2.11.2-150600.4.18.1 * freerdp-debuginfo-2.11.2-150600.4.18.1 Read the Full Advisory

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)

* freerdp-proxy-2.11.2-150600.4.18.1

* freerdp-devel-2.11.2-150600.4.18.1

* freerdp-server-debuginfo-2.11.2-150600.4.18.1

* freerdp-wayland-2.11.2-150600.4.18.1

* uwac0-0-devel-2.11.2-150600.4.18.1

* freerdp-wayland-debuginfo-2.11.2-150600.4.18.1

* libwinpr2-2-2.11.2-150600.4.18.1

* libwinpr2-2-debuginfo-2.11.2-150600.4.18.1

* libuwac0-0-2.11.2-150600.4.18.1

* freerdp-proxy-debuginfo-2.11.2-150600.4.18.1

* winpr-devel-2.11.2-150600.4.18.1

* libuwac0-0-debuginfo-2.11.2-150600.4.18.1

* freerdp-debuginfo-2.11.2-150600.4.18.1

* freerdp-debugsource-2.11.2-150600.4.18.1

* libfreerdp2-2-2.11.2-150600.4.18.1

* freerdp-2.11.2-150600.4.18.1

* freerdp-server-2.11.2-150600.4.18.1

* libfreerdp2-2-debuginfo-2.11.2-150600.4.18.1

* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)

* uwac0-0-devel-2.11.2-150600.4.18.1

* freerdp-debuginfo-2.11.2-150600.4.18.1

* bsc#1258979 * bsc#1258982 * bsc#1258985 * bsc#1259653 * bsc#1259679 * bsc#1259686 ## References: * * * * * * * * * * * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in FreeRDP Addressed by SUSE Security Update SUSE has released a security update for FreeRDP, addressing six critical vulnerabilities. The issues include buffer overreads and out-of-bounds writes, which could lead to heap buffer overflows and arbitrary code execution. Specifically, CVE-2026-31806 and CVE-2026-31883 are particularly concerning due to their potential for remote exploitation. The vulnerabilities affect multiple architectures, including aarch64, ppc64le, s390x, x86_64, and i586. The update provides patch instructions for users to mitigate these risks. Users are advised to apply the patches using recommended installation methods like YaST or zypper. The vulnerabilities were disclosed in late February and early March 2026, with the update published on March 31, 2026. Immediate action is recommended to secure affected systems. 2 sources 72

Extracted Entities

Companies (2)

OpenSUSE SuSE

CVEs (6)

CVE-2026-26271 CVE-2026-26955 CVE-2026-26965 CVE-2026-31806 CVE-2026-31883 CVE-2026-31885