# ALSA-2026:94514: Security update for 6 packages ALSA-2026:94514, released November 7, 2026, fixes 18 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-94514 - Platform: Linux - Released: Nov 7, 2026 - Priority: High (Closes CVE-2026-114045, high severity) - CVEs: 18, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:94514 ## Applies to | Product | Release | Fixed in | |---|---|---| | [freerdp](https://patchblox.com/security/data/product/linux/freerdp.md) | almalinux 10 | 2:3.32.2-1.el10_2 | | [freerdp-devel](https://patchblox.com/security/data/product/linux/freerdp-devel.md) | almalinux 10 | 2:3.32.2-1.el10_2 | | [freerdp-libs](https://patchblox.com/security/data/product/linux/freerdp-libs.md) | almalinux 10 | 2:3.32.2-1.el10_2 | | [freerdp-server](https://patchblox.com/security/data/product/linux/freerdp-server.md) | almalinux 10 | 2:3.32.2-1.el10_2 | | [libwinpr](https://patchblox.com/security/data/product/linux/libwinpr.md) | almalinux 10 | 2:3.32.2-1.el10_2 | | [libwinpr-devel](https://patchblox.com/security/data/product/linux/libwinpr-devel.md) | almalinux 10 | 2:3.32.2-1.el10_2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-114045](https://patchblox.com/security/data/cve/CVE-2026-114045.md) | High | freerdp3: FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wrap... | 8.8 | 0.0058 | | | [CVE-2026-111378](https://patchblox.com/security/data/cve/CVE-2026-111378.md) | High | freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu th... | 8.8 | 0.0052 | | | [CVE-2026-111382](https://patchblox.com/security/data/cve/CVE-2026-111382.md) | High | freerdp3: FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and gener... | 8.8 | 0.0038 | | | [CVE-2026-110837](https://patchblox.com/security/data/cve/CVE-2026-110837.md) | High | freerdp3: FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow i... | 8.8 | 0.0037 | | | [CVE-2026-110838](https://patchblox.com/security/data/cve/CVE-2026-110838.md) | High | freerdp3: FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentic... | 8.8 | 0.0033 | | | [CVE-2026-111880](https://patchblox.com/security/data/cve/CVE-2026-111880.md) | High | freerdp3: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path th... | 8.8 | 0.0032 | | | [CVE-2026-110830](https://patchblox.com/security/data/cve/CVE-2026-110830.md) | High | freerdp3-shadow-x11: FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP serv... | 8.8 | 0.0032 | | | [CVE-2026-110833](https://patchblox.com/security/data/cve/CVE-2026-110833.md) | High | freerdp3: FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR ch... | 8.8 | 0.0032 | | | [CVE-2026-109242](https://patchblox.com/security/data/cve/CVE-2026-109242.md) | High | freerdp3-shadow-x11: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles beca... | 8.8 | 0.0030 | | | [CVE-2026-110839](https://patchblox.com/security/data/cve/CVE-2026-110839.md) | High | libwinpr-tools3-3: FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr... | 8.8 | 0.0027 | | | [CVE-2026-121386](https://patchblox.com/security/data/cve/CVE-2026-121386.md) | High | freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_co... | 7.5 | 0.0027 | | | [CVE-2026-109676](https://patchblox.com/security/data/cve/CVE-2026-109676.md) | High | freerdp3-shadow-x11: FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows atta... | 8.8 | 0.0026 | | | [CVE-2026-111379](https://patchblox.com/security/data/cve/CVE-2026-111379.md) | High | freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows loc... | 8.8 | 0.0019 | | | [CVE-2026-111381](https://patchblox.com/security/data/cve/CVE-2026-111381.md) | High | freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows loc... | 8.8 | 0.0018 | | | [CVE-2026-121404](https://patchblox.com/security/data/cve/CVE-2026-121404.md) | Routine | freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP c... | 6.5 | 0.0038 | | | [CVE-2026-121388](https://patchblox.com/security/data/cve/CVE-2026-121388.md) | Routine | freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP... | 6.5 | 0.0031 | | | [CVE-2026-121394](https://patchblox.com/security/data/cve/CVE-2026-121394.md) | Routine | freerdp3: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious se... | 6.5 | 0.0025 | | | [CVE-2026-121402](https://patchblox.com/security/data/cve/CVE-2026-121402.md) | Routine | freerdp3: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xf... | 6.5 | 0.0025 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo