{"id":"CLSA-2026-1775223344","summary":"freerdp: Fix of 3 CVEs","details":"- CVE-2023-39355: fix use-after-free in RDPGFX_CMDID_RESETGRAPHICS handling when\n  context-\u003emaxPlaneSize == 0; update context-\u003eplanesBuffer after free and\n  prevent access to freed memory\n- CVE-2026-26965: fix heap out-of-bounds write in RLE planar decode that permit\n  attacker-controlled pixel data and offset overwrite adjacent function pointer;\n  validate (nYDst+nSrcHeight) and (nXDst+nSrcWidth) against destination bounds\n  and ensure writes use correct buffer, prevent OOB write\n- CVE-2026-26955: fix heap buffer overflow in GDI surface pipeline caused by\n  out-of-bounds ClearCodec destination rectangle; add top-level guard in\n  clear_decompress() to validate nXDst/nYDst against destination surface\n  dimensions protecting all code paths (bands, residual, glyph, subcodec);\n  fix subcodec bounds checks to compare against destination dimensions","modified":"2026-05-27T11:35:51.623583698Z","published":"2026-04-10T16:18:55Z","upstream":["CVE-2023-39355","CVE-2026-26955","CVE-2026-26965"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1775223344.html"}],"affected":[{"package":{"name":"freerdp","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/freerdp?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1775223344.json"}},{"package":{"name":"freerdp-devel","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/freerdp-devel?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1775223344.json"}},{"package":{"name":"freerdp-libs","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/freerdp-libs?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1775223344.json"}},{"package":{"name":"libwinpr","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/libwinpr?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1775223344.json"}},{"package":{"name":"libwinpr-devel","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/libwinpr-devel?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1775223344.json"}}],"schema_version":"1.7.5"}