Skip to content
OpenAdvisories
High ALSA-2026:2048 7 CVEs

Important: freerdp security update

Published Feb 5, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)
* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)
* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)
* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)
* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 9 freerdp 2:2.11.7-1.el9_7.1
AlmaLinux · 9 freerdp-devel 2:2.11.7-1.el9_7.1
AlmaLinux · 9 freerdp-libs 2:2.11.7-1.el9_7.1
AlmaLinux · 9 libwinpr 2:2.11.7-1.el9_7.1
AlmaLinux · 9 libwinpr-devel 2:2.11.7-1.el9_7.1

Vulnerabilities 7

  • High 7.7
    CVE-2026-23530

    FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23531

    FreeRDP has heap-buffer-overflow in clear_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bou…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23532

    FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual cop…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23533

    FreeRDP has heap-buffer-overflow in clear_decompress_residual_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23534

    FreeRDP has heap-buffer-overflow in clear_decompress_bands_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23883

    Heap-use-after-free in update_pointer_new

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23884

    Heap-use-after-free in gdi_set_bounds

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-23530
  • report
    https://access.redhat.com/security/cve/CVE-2026-23531
  • report
    https://access.redhat.com/security/cve/CVE-2026-23532
  • report
    https://access.redhat.com/security/cve/CVE-2026-23533
  • report
    https://access.redhat.com/security/cve/CVE-2026-23534
  • report
    https://access.redhat.com/security/cve/CVE-2026-23883
  • report
    https://access.redhat.com/security/cve/CVE-2026-23884
  • report
    https://bugzilla.redhat.com/2430877
  • report
    https://bugzilla.redhat.com/2430880
  • report
    https://bugzilla.redhat.com/2430885
  • report
    https://bugzilla.redhat.com/2430886
  • report
    https://bugzilla.redhat.com/2430887
  • report
    https://bugzilla.redhat.com/2430888
  • report
    https://bugzilla.redhat.com/2430891
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-2048.html