Linux · Security advisory · October 6, 2026
ELSA-2026-75570: Security update for 6 packages
ELSA-2026-75570, released October 6, 2026, fixes 11 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0067
51st percentile
Priority of the 11 CVEs
Patch now 0
Urgent 0
High 11
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| freerdp | ol 10 | 2:3.10.3-12.el10_2.14 |
| freerdp-devel | ol 10 | 2:3.10.3-12.el10_2.14 |
| freerdp-libs | ol 10 | 2:3.10.3-12.el10_2.14 |
| freerdp-server | ol 10 | 2:3.10.3-12.el10_2.14 |
| libwinpr | ol 10 | 2:3.10.3-12.el10_2.14 |
| libwinpr-devel | ol 10 | 2:3.10.3-12.el10_2.14 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-91963 | freerdp3: FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redire... | 8.8 | 0.0067 | None reported | |
| High | CVE-2026-91964 | freerdp3: FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing... | 8.8 | 0.0060 | None reported | |
| High | CVE-2026-91946 | freerdp3: FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics P... | 8.8 | 0.0053 | None reported | |
| High | CVE-2026-91953 | freerdp: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | 8.8 | 0.0047 | None reported | |
| High | CVE-2026-91960 | freerdp3: FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that al... | 8.8 | 0.0046 | None reported | |
| High | CVE-2026-91950 | freerdp3: FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit un... | 8.8 | 0.0040 | None reported | |
| High | CVE-2026-91954 | freerdp: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | 8.8 | 0.0039 | None reported | |
| High | CVE-2026-91956 | freerdp: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | 8.8 | 0.0039 | None reported | |
| High | CVE-2026-91959 | freerdp: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | 8.8 | 0.0039 | None reported | |
| High | CVE-2026-85089 | freerdp3: FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU res... | 8.8 | 0.0038 | None reported | |
| High | CVE-2026-91947 | freerdp3: FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences... | 8.8 | 0.0037 | None reported |
Showing 1 to 11 of 11
1