Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-121964: FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution. CVE-2026-121962: FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service. CVE-2026-121960: FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process. CVE-2026-121958: FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS. CVE-2026-121957: FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers. CVE-2026-121956: FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process. CVE-2026-121955: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation. CVE-2026-121951: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | freerdp | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-debuginfo | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-debugsource | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-devel | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-libs | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-libs-debuginfo | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-server | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | freerdp-server-debuginfo | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | libwinpr | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | libwinpr-debuginfo | 2:3.33.0-3.amzn2023 |
| Amazon Linux · 2023 | libwinpr-devel | 2:3.33.0-3.amzn2023 |
Vulnerabilities 8
-
High 8.8
FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious…
-
High 8.1
FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read
FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance…
-
High 7.5
FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP…
-
High 7.5
FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, t…
-
High 7.5
FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt
FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a c…
-
High 7.5
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending …
-
High 7.5
FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest
FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal…
-
High 7.5
FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment
FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining cap…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121951.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121955.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121956.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121957.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121958.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121960.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121962.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-121964.html