Skip to content
OpenAdvisories
High ALSA-2026:61378 13 CVEs

Important: freerdp security update

Published Aug 31, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)
* FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
* FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
* FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
* FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)
* FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)
* FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)
* FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)
* FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)
* FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)
* FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)
* freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)
* FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 freerdp 2:3.10.3-12.el10_2.10
AlmaLinux · 10 freerdp-devel 2:3.10.3-12.el10_2.10
AlmaLinux · 10 freerdp-libs 2:3.10.3-12.el10_2.10
AlmaLinux · 10 freerdp-server 2:3.10.3-12.el10_2.10
AlmaLinux · 10 libwinpr 2:3.10.3-12.el10_2.10
AlmaLinux · 10 libwinpr-devel 2:3.10.3-12.el10_2.10

Vulnerabilities 13

  • High 8.7
    CVE-2026-55194

    FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.3
    CVE-2026-73241

    FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTH…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.3
    CVE-2026-73242

    FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV poi…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.7
    CVE-2026-63633

    FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-suppl…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67288

    FreeRDP before 3.29.0 Denial of Service via smartcard cache

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67291

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67296

    FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

    FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared bod…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67297

    FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

    FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67298

    FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67301

    FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67304

    FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-63652

    FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or n…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.4
    CVE-2026-69159 Rejected

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE…

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-55194
  • report
    https://access.redhat.com/security/cve/CVE-2026-63633
  • report
    https://access.redhat.com/security/cve/CVE-2026-63652
  • report
    https://access.redhat.com/security/cve/CVE-2026-67288
  • report
    https://access.redhat.com/security/cve/CVE-2026-67291
  • report
    https://access.redhat.com/security/cve/CVE-2026-67296
  • report
    https://access.redhat.com/security/cve/CVE-2026-67297
  • report
    https://access.redhat.com/security/cve/CVE-2026-67298
  • report
    https://access.redhat.com/security/cve/CVE-2026-67301
  • report
    https://access.redhat.com/security/cve/CVE-2026-67304
  • report
    https://access.redhat.com/security/cve/CVE-2026-69159
  • report
    https://access.redhat.com/security/cve/CVE-2026-73241
  • report
    https://access.redhat.com/security/cve/CVE-2026-73242
  • report
    https://bugzilla.redhat.com/2509986
  • report
    https://bugzilla.redhat.com/2509994
  • report
    https://bugzilla.redhat.com/2510001
  • report
    https://bugzilla.redhat.com/2510010
  • report
    https://bugzilla.redhat.com/2510029
  • report
    https://bugzilla.redhat.com/2510034
  • report
    https://bugzilla.redhat.com/2510041
  • report
    https://bugzilla.redhat.com/2514346
  • report
    https://bugzilla.redhat.com/2514349
  • report
    https://bugzilla.redhat.com/2519822
  • report
    https://bugzilla.redhat.com/2519824
  • report
    https://bugzilla.redhat.com/2519826
  • report
    https://bugzilla.redhat.com/2519828
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-61378.html