Skip to content
OpenAdvisories
High ALSA-2026:3334 3 CVEs

Important: freerdp security update

Published Feb 25, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855)
* freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858)
* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 8 freerdp 2:2.11.7-3.el8_10
AlmaLinux · 8 freerdp-devel 2:2.11.7-3.el8_10
AlmaLinux · 8 freerdp-libs 2:2.11.7-3.el8_10
AlmaLinux · 8 libwinpr 2:2.11.7-3.el8_10
AlmaLinux · 8 libwinpr-devel 2:2.11.7-3.el8_10

Vulnerabilities 3

  • Medium 5.6
    CVE-2026-22855

    FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-22855
  • report
    https://access.redhat.com/security/cve/CVE-2026-22858
  • report
    https://access.redhat.com/security/cve/CVE-2026-22859
  • report
    https://bugzilla.redhat.com/2429645
  • report
    https://bugzilla.redhat.com/2429649
  • report
    https://bugzilla.redhat.com/2429653
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-3334.html