SUSE-SU-2026:0656-1

CVE-2026-22855: heap-buffer-overflow in smartcardunpacksetattribcall (bsc#1256721).
CVE-2026-22857: heap-use-after-free in irpthreadfunc (bsc#1256723).
CVE-2026-23533: improper validation can lead to heap buffer overflow in clear_decompress_residual_data (bsc#1256943).
CVE-2026-23732: improper validation can lead to heap buffer overflow in Glyph_Alloc (bsc#1256945).
CVE-2026-23883: use-after-free when update_pointer_color and freerdp_image_copy_from_pointer_data fail (bsc#1256946).
CVE-2026-23884: use-after-free in gdi_set_bounds (bsc#1256947).

References

Affected packages

Name: freerdp
Purl: pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.0-150400.3.41.1

{
    "binaries": [
        {
            "libfreerdp2": "2.4.0-150400.3.41.1",
            "libwinpr2": "2.4.0-150400.3.41.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:0656-1.json"