Skip to content
OpenAdvisories
High ALSA-2026:50747 1 CVE

Important: freerdp security update

Published Aug 5, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 freerdp 2:3.10.3-12.el10_2.7
AlmaLinux · 10 freerdp-devel 2:3.10.3-12.el10_2.7
AlmaLinux · 10 freerdp-libs 2:3.10.3-12.el10_2.7
AlmaLinux · 10 freerdp-server 2:3.10.3-12.el10_2.7
AlmaLinux · 10 libwinpr 2:3.10.3-12.el10_2.7
AlmaLinux · 10 libwinpr-devel 2:3.10.3-12.el10_2.7

Vulnerabilities 1

  • High 7.5
    CVE-2026-55827

    FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-55827
  • report
    https://bugzilla.redhat.com/2499159
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-50747.html