Skip to content
OpenAdvisories
High ALSA-2026:54486 6 CVEs

Important: freerdp security update

Published Aug 13, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)
* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)
* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)
* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)
* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)
* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 freerdp 2:3.10.3-12.el10_2.8
AlmaLinux · 10 freerdp-devel 2:3.10.3-12.el10_2.8
AlmaLinux · 10 freerdp-libs 2:3.10.3-12.el10_2.8
AlmaLinux · 10 freerdp-server 2:3.10.3-12.el10_2.8
AlmaLinux · 10 libwinpr 2:3.10.3-12.el10_2.8
AlmaLinux · 10 libwinpr-devel 2:3.10.3-12.el10_2.8

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-64620

    FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

    FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward check…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2026-67289

    FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.8
    CVE-2026-64624

    FreeRDP RDP File Parser Remote Code Execution via CLI Options

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67299

    FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-68580

    FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.3
    CVE-2026-64621

    FreeRDP before 3.28.0 Double-Free via selectedmonitors

    FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-64620
  • report
    https://access.redhat.com/security/cve/CVE-2026-64621
  • report
    https://access.redhat.com/security/cve/CVE-2026-64624
  • report
    https://access.redhat.com/security/cve/CVE-2026-67289
  • report
    https://access.redhat.com/security/cve/CVE-2026-67299
  • report
    https://access.redhat.com/security/cve/CVE-2026-68580
  • report
    https://bugzilla.redhat.com/2502752
  • report
    https://bugzilla.redhat.com/2502766
  • report
    https://bugzilla.redhat.com/2503096
  • report
    https://bugzilla.redhat.com/2509985
  • report
    https://bugzilla.redhat.com/2510004
  • report
    https://bugzilla.redhat.com/2510125
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-54486.html