An update for freerdp is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-1402 Final 1.0 1.0 2026-02-13 Initial 2026-02-13 2026-02-13 openEuler SA Tool V1.0 2026-02-13 freerdp security update An update for freerdp is now available for openEuler-24.03-LTS-SP3 FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp. Security Fix(es): FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap buffer overflow vulnerability exists in the `drive_process_irp_read` function. When processing drive read requests, the function uses a server-controlled read length to copy file data into an IRP output stream buffer, but lacks a hard upper bound on this length. A malicious server can exploit this flaw by issuing an oversized read request, triggering a heap buffer overflow on the client side. This can lead to application crash (Denial of Service) and heap memory corruption, with potential code execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-22854) An update for freerdp is now available for openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium freerdp https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1402 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-22854 https://nvd.nist.gov/vuln/detail/CVE-2026-22854 openEuler-24.03-LTS-SP3 freerdp-2.11.7-4.oe2403sp3.aarch64.rpm freerdp-debuginfo-2.11.7-4.oe2403sp3.aarch64.rpm freerdp-debugsource-2.11.7-4.oe2403sp3.aarch64.rpm freerdp-devel-2.11.7-4.oe2403sp3.aarch64.rpm freerdp-help-2.11.7-4.oe2403sp3.aarch64.rpm libwinpr-2.11.7-4.oe2403sp3.aarch64.rpm libwinpr-devel-2.11.7-4.oe2403sp3.aarch64.rpm freerdp-2.11.7-4.oe2403sp3.src.rpm freerdp-2.11.7-4.oe2403sp3.x86_64.rpm freerdp-debuginfo-2.11.7-4.oe2403sp3.x86_64.rpm freerdp-debugsource-2.11.7-4.oe2403sp3.x86_64.rpm freerdp-devel-2.11.7-4.oe2403sp3.x86_64.rpm freerdp-help-2.11.7-4.oe2403sp3.x86_64.rpm libwinpr-2.11.7-4.oe2403sp3.x86_64.rpm libwinpr-devel-2.11.7-4.oe2403sp3.x86_64.rpm FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap buffer overflow vulnerability exists in the `drive_process_irp_read` function. When processing drive read requests, the function uses a server-controlled read length to copy file data into an IRP output stream buffer, but lacks a hard upper bound on this length. A malicious server can exploit this flaw by issuing an oversized read request, triggering a heap buffer overflow on the client side. This can lead to application crash (Denial of Service) and heap memory corruption, with potential code execution risk depending on allocator behavior and surrounding heap layout. 2026-02-13 CVE-2026-22854 openEuler-24.03-LTS-SP3 Medium 6.8 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X freerdp security update 2026-02-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1402