Skip to content
OpenAdvisories
High ALSA-2026:36203 5 CVEs

Important: freerdp security update

Published Jul 7, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)
* freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)
* freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)
* freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)
* freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 freerdp 2:3.10.3-12.el10_2.6
AlmaLinux · 10 freerdp-devel 2:3.10.3-12.el10_2.6
AlmaLinux · 10 freerdp-libs 2:3.10.3-12.el10_2.6
AlmaLinux · 10 freerdp-server 2:3.10.3-12.el10_2.6
AlmaLinux · 10 libwinpr 2:3.10.3-12.el10_2.6
AlmaLinux · 10 libwinpr-devel 2:3.10.3-12.el10_2.6

Vulnerabilities 5

  • High 8.8
    CVE-2026-40033

    FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

    FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.8
    CVE-2026-44420

    FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySet…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.8
    CVE-2026-44421

    FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destinatio…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.7
    CVE-2026-45700

    Heap-buffer-overflow write in planar bitmap decoder

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X d…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-44422

    FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. Whe…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-40033
  • report
    https://access.redhat.com/security/cve/CVE-2026-44420
  • report
    https://access.redhat.com/security/cve/CVE-2026-44421
  • report
    https://access.redhat.com/security/cve/CVE-2026-44422
  • report
    https://access.redhat.com/security/cve/CVE-2026-45700
  • report
    https://bugzilla.redhat.com/2481473
  • report
    https://bugzilla.redhat.com/2483467
  • report
    https://bugzilla.redhat.com/2483470
  • report
    https://bugzilla.redhat.com/2483471
  • report
    https://bugzilla.redhat.com/2483480
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-36203.html