Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56297: FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service. CVE-2026-24684: Client side issue with FreeRDP CVE-2026-24683: Client side issue with FreeRDP CVE-2026-24681: Client side issue with FreeRDP CVE-2026-24679: Client side issue with FreeRDP CVE-2026-24677: Client side issue with FreeRDP CVE-2026-24676: Client side issue with FreeRDP CVE-2026-24675: Client side issue with FreeRDP CVE-2026-24491: Client side issue with FreeRDP CVE-2026-23948: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | freerdp | 2:2.11.7-1.amzn2.0.5 |
| Amazon Linux · 2 | freerdp-debuginfo | 2:2.11.7-1.amzn2.0.5 |
| Amazon Linux · 2 | freerdp-devel | 2:2.11.7-1.amzn2.0.5 |
| Amazon Linux · 2 | freerdp-libs | 2:2.11.7-1.amzn2.0.5 |
| Amazon Linux · 2 | libwinpr | 2:2.11.7-1.amzn2.0.5 |
| Amazon Linux · 2 | libwinpr-devel | 2:2.11.7-1.amzn2.0.5 |
Vulnerabilities 10
-
High 8.7
FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. This vulnerability is…
-
High 8.7
FreeRDP has a heap-buffer-overflow in urb_select_interface
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerabilit…
-
High 8.7
FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is f…
-
High 8.7
FreeRDP has a heap-use-after-free in ainput_send_input_event
FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use …
-
High 8.7
FreeRDP has a Heap-use-after-free in play_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerab…
-
High 7.7
FreeRDP has a heap-use-after-free in video_timer
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.2…
-
High 7.7
FreeRDP has a Heap-use-after-free in urb_select_interface
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerabili…
-
High 7.7
FreeRDP has a heap-use-after-free in audio_format_compatible
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vuln…
-
High 7.0
FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback
FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CL…
-
Medium 6.9
FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cb…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23948.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24491.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24675.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24676.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24677.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24679.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24681.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24683.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-24684.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56297.html