What is the CVSS score of EUVD-2026-62666?

EUVD-2026-62666 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-62666?

Yes, a patch is available for EUVD-2026-62666. Update the affected software to the latest version immediately.

FreeRDP EUVD-2026-62666

| CVE-2026-55648 MEDIUM

Integer Overflow or Wraparound (CWE-190)

N/A vendor:alpine

Information Disclosure Integer Overflow Freerdp

6.1

CVSS 4.0 · Vendor: vendor:alpine

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Unknown - insufficient vulnerability detail to construct kill chain

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation conditions cannot be determined - the CVE description contains no technical detail about the vulnerability, required configuration, affected feature, protocol, or deployment mode. No CVSS vector is available to infer authentication requirements or attack vector. Authentication requirements are not confirmed from available data. Until a detailed advisory is published, defenders should not assume any specific exploitation prerequisite.
Impact	Risk assessment is severely limited by the absence of CVSS score, CVSS vector, EPSS score, CWE, KEV status, POC information, and a meaningful vulnerability description. The sole confirmed data point is that Alpine Linux issued a patched package (3.27.1-r0). No exploitation activity has been confirmed, no public exploit code has been identified, and CISA has not listed this in the KEV catalog. Attack vector, complexity, privilege requirements, and impact scope are all unknown. Security teams should treat this as an uncharacterized vulnerability requiring vendor follow-up before accurate prioritization is possible.
Exploit ScenarioDerived	An exploit scenario cannot be constructed from the available data. The vulnerability type, attack vector, and required conditions are entirely undisclosed. No proof-of-concept code has been identified, and no active exploitation has been confirmed.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

FreeRDP received a security fix in Alpine Linux package version 3.27.1-r0, addressing an undisclosed vulnerability. The nature, severity, and impact of the underlying flaw are not specified in the available intelligence - no CVE description, CVSS score, CWE classification, or advisory has been published at time of analysis. FreeRDP is an open-source RDP client and server implementation widely used on Linux systems; until further details are disclosed, the risk to affected deployments cannot be quantified.

RemediationAI

Upgrade the FreeRDP package on Alpine Linux to version 3.27.1-r0 or later using the Alpine package manager: 'apk upgrade freerdp'. This is the only confirmed remediation action available from the provided data. No specific workarounds have been documented because the underlying vulnerability type is unknown. If immediate patching is not possible, consider restricting access to systems running FreeRDP as a server, or limiting outbound RDP connections from hosts using FreeRDP as a client, until the vulnerability details are disclosed and risk can be properly assessed. No advisory URL is available to cite.

Affected VersionsENISA

FreeRDP < 3.27.0

Affected Packages

euvd freerdp fix: 3.27.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

FreeRDP is a free, open-source implementation of Microsoft's Remote Desktop Protocol (RDP), supporting both client and server roles. It is commonly used on Linux distributions to connect to Windows remote desktop environments or to host RDP-accessible sessions. Alpine Linux distributes FreeRDP as a package, and version 3.27.1-r0 of that package was identified as the fix release. No CWE is provided, so the root cause class - whether memory corruption, authentication bypass, input validation failure, or another category - cannot be determined from available data. No CPE strings were provided to further constrain the affected component.

Know when Freerdp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:alpine) PRIMARY 6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vendor:alpine) · only source for this CVE.

CVSS VectorVendor: vendor:alpine

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Aug 19, 2026 - 19:18 EUVD

CVSS changed

Aug 19, 2026 - 18:22 NVD

6.1 (MEDIUM)

DescriptionCVE.org

Alpine Linux: freerdp fixed in 3.27.1-r0

Threat Intelligence Overview

EPSS Score

0.5%

Top 56% exploitable

Prevalence

Medium

widely used RDP client on Linux desktop and server deployments

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +30

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.