Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73242: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0. CVE-2026-73241: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0. CVE-2026-72746: FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available. CVE-2026-72745: FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service. CVE-2026-68580: FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms. CVE-2026-67306: FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0-15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0. CVE-2026-67304: FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions. CVE-2026-67303: FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service). CVE-2026-67302: FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0. CVE-2026-67301: FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | freerdp | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-debuginfo | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-debugsource | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-libs-debuginfo | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | freerdp-server-debuginfo | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | libwinpr-debuginfo | 2:3.6.3-1.amzn2023.0.15 |
| Amazon Linux · 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.15 |
Vulnerabilities 22
-
Critical 9.8
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN str…
-
Critical 9.8
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…
-
High 8.7CVE-2026-72745 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242.
-
High 8.7CVE-2026-72746 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.
-
High 8.3
FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTH…
-
High 8.3
FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV poi…
-
High 7.8
FreeRDP RDP File Parser Remote Code Execution via CLI Options
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…
-
High 7.5
FreeRDP before 3.29.0 Denial of Service via smartcard cache
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…
-
High 7.5
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…
-
High 7.5
FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust …
-
High 7.5
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…
-
High 7.5
FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…
-
High 7.5
FreeRDP before 3.29.0 Use-After-Free via async message proxy
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted upda…
-
High 7.5
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…
-
High 7.5
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to…
-
High 7.5
FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…
-
Medium 6.3
FreeRDP before 3.29.0 Path Traversal via drive redirection
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sib…
-
Medium 5.9
FreeRDP before 3.29.0 TLS Certificate EKU Bypass
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back…
-
Medium 5.4
FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is boun…
-
Medium 4.3
FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU…
-
Medium 4.3
FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_D…
-
Medium 4.2
FreeRDP before 3.29.0 Improper Certificate Hostname Validation
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64624.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-66402.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67288.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67289.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67291.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67293.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67294.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67297.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67298.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67299.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67300.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67301.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67302.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67303.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67304.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-67306.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68580.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-72745.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-72746.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73241.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73242.html