Skip to content
OpenAdvisories
High ELSA-2026-4471 3 CVEs

Important: freerdp security update (Oracle Linux 7)

Published Mar 27, 2026 · Updated Mar 27, 2026

Ecosystem: Oracle Linux

Summary

[2:2.2.0-5.0.3]
- Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086]

[2:2.2.0-5.0.1]
- fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533
CVE-2026-23884 [Orabug: 38971897]

[2:2.2.0-5]
- Update: Refactored RPC gateway parser (rhbz#2017944)
+ fix issues discovered by Covscan

[2:2.2.0-4]
- Refactored RPC gateway parser (rhbz#2017944)

[2.1.1-3]
- Add checks for bitmap and glyph width/heigth values (rhbz#2017951)

[2.1.1-2]
- Update to 2.1.1 (#1834286)

[2.0.0-4.rc4]
- CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
- CVE-2020-11523: Fix integer overflow in region.c (#1837622)
- CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)

[2.0.0-2.rc4]
- Fix SCARD_INSUFFICIENT_BUFFER error (#1765199)

[2.0.0-1.rc4]
- Update to 2.0.0-rc4 (#1291254)

[1.0.2-15]
- Fix smartcard usage in manpage (#1428041)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 freerdp 0:2.1.1-5.0.3.el7_9
Oracle Linux · 7 freerdp-devel 0:2.1.1-5.0.3.el7_9
Oracle Linux · 7 freerdp-libs 0:2.1.1-5.0.3.el7_9
Oracle Linux · 7 libwinpr 0:2.1.1-5.0.3.el7_9
Oracle Linux · 7 libwinpr-devel 0:2.1.1-5.0.3.el7_9

Vulnerabilities 3

  • Medium 5.6
    CVE-2026-22855

    FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi