Linux · Security advisory · November 7, 2026

ALSA-2026:94514: Security update for 6 packages

ALSA-2026:94514, released November 7, 2026, fixes 18 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
18
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0058
47th percentile

Priority of the 18 CVEs

Patch now 0 Urgent 0 High 14 Routine 4

Fixed package versions

ProductReleaseFixed in
freerdpalmalinux 102:3.32.2-1.el10_2
freerdp-develalmalinux 102:3.32.2-1.el10_2
freerdp-libsalmalinux 102:3.32.2-1.el10_2
freerdp-serveralmalinux 102:3.32.2-1.el10_2
libwinpralmalinux 102:3.32.2-1.el10_2
libwinpr-develalmalinux 102:3.32.2-1.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-114045 freerdp3: FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wrap... 8.8 0.0058 None reported
High CVE-2026-111378 freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu th... 8.8 0.0052 None reported
High CVE-2026-111382 freerdp3: FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and gener... 8.8 0.0038 None reported
High CVE-2026-110837 freerdp3: FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow i... 8.8 0.0037 None reported
High CVE-2026-110838 freerdp3: FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentic... 8.8 0.0033 None reported
High CVE-2026-111880 freerdp3: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path th... 8.8 0.0032 None reported
High CVE-2026-110830 freerdp3-shadow-x11: FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP serv... 8.8 0.0032 None reported
High CVE-2026-110833 freerdp3: FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR ch... 8.8 0.0032 None reported
High CVE-2026-109242 freerdp3-shadow-x11: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles beca... 8.8 0.0030 None reported
High CVE-2026-110839 libwinpr-tools3-3: FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr... 8.8 0.0027 None reported
High CVE-2026-121386 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_co... 7.5 0.0027 None reported
High CVE-2026-109676 freerdp3-shadow-x11: FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows atta... 8.8 0.0026 None reported
High CVE-2026-111379 freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows loc... 8.8 0.0019 None reported
High CVE-2026-111381 freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows loc... 8.8 0.0018 None reported
Routine CVE-2026-121404 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP c... 6.5 0.0038 None reported
Routine CVE-2026-121388 freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP... 6.5 0.0031 None reported
Routine CVE-2026-121394 freerdp3: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious se... 6.5 0.0025 None reported
Routine CVE-2026-121402 freerdp3: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xf... 6.5 0.0025 None reported
Showing 1 to 18 of 18 1