Back Linuxsecurity

SUSE freerdp Important Security Fix for 18 Issues 2026-0345

Linuxsecurity •LinuxSecurity Advisories • January 30, 2026

## This update for freerdp fixes the following issues: * CVE-2025-4478: Fixed initialization of function pointers after resource allocations (bsc#1243109) * CVE-2026-22851: Fixed RDPGFX ResetGraphics race leading to use-after-free in SDL client (sdl->primary) (bsc#1256717) * CVE-2026-22852: Fixed heap-buffer-overflow in audin_process_formats (bsc#1256718) * CVE-2026-22853: Fixed heap-buffer-overflow in ndr_read_uint8Array (bsc#1256719) * CVE-2026-22854: Fixed heap-buffer-overflow in drive_process_irp_read (bsc#1256720) * CVE-2026-22855: Fixed heap-buffer-overflow in smartcard_unpack_set_attrib_call (bsc#1256721) * CVE-2026-22856: Fixed heap-use-after-free in create_irp_thread (bsc#1256722) * CVE-2026-22857: Fixed heap-use-after-free in irp_thread_func (bsc#1256723) Read the Full Advisory

* bsc#1243109 * bsc#1256717 * bsc#1256718 * bsc#1256719 * bsc#1256720 * bsc#1256721 * bsc#1256722 * bsc#1256723 * bsc#1256724 * bsc#1256725 * bsc#1256940 * bsc#1256941 * bsc#1256942 * bsc#1256943 * bsc#1256944 * bsc#1256945 * bsc#1256946 * bsc#1256947 Cross- * CVE-2025-4478 * CVE-2026-22851 * CVE-2026-22852 * CVE-2026-22853 * CVE-2026-22854 * CVE-2026-22855 * CVE-2026-22856 * CVE-2026-22857 * CVE-2026-22858 * CVE-2026-22859 * CVE-2026-23530 * CVE-2026-23531 * CVE-2026-23532 * CVE-2026-23533 * CVE-2026-23534 * CVE-2026-23732 * CVE-2026-23883 * CVE-2026-23884 CVSS scores: * CVE-2025-4478 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2025-4478 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Read the Full Advisory

* CVE-2025-4478 ( SUSE ): 7.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

* CVE-2025-4478 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Read the Full Advisory

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Heap Buffer Overflow Vulnerabilities in FreeRDP Affecting SUSE and openSUSE Recent updates for FreeRDP address multiple heap buffer overflow vulnerabilities identified as CVE-2026-22852, CVE-2026-22854, CVE-2026-22856, and CVE-2026-22859. These vulnerabilities can be exploited by malicious RDP servers to cause heap overflows and use-after-free conditions, impacting users of SUSE and openSUSE systems. The vulnerabilities were published on January 14, 2026, and have been addressed in security updates released on February 10, 2026. 12 sources 35

Extracted Entities

Companies (1)

SuSE

CVEs (18)

CVE-2025-4478 CVE-2026-22851 CVE-2026-22852 CVE-2026-22853 CVE-2026-22854 CVE-2026-22855 CVE-2026-22856 CVE-2026-22857 CVE-2026-22858 CVE-2026-22859 CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23534 CVE-2026-23732 CVE-2026-23883 CVE-2026-23884