Skip to content
OpenAdvisories
Critical ELSA-2026-73979 1 CVE

Critical: freerdp security update (Oracle Linux 10)

Published Sep 30, 2026 · Updated Sep 30, 2026

Ecosystem: Oracle Linux

Summary

[2:3.10.3-12.13]
- Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949)
Resolves: RHEL-264913

[2:3.10.3-12.12]
- Fix several regressions in CVE-2026-73241
Resolves: RHEL-257781

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 10 freerdp 2:3.10.3-12.el10_2.13
Oracle Linux · 10 freerdp-devel 2:3.10.3-12.el10_2.13
Oracle Linux · 10 freerdp-libs 2:3.10.3-12.el10_2.13
Oracle Linux · 10 freerdp-server 2:3.10.3-12.el10_2.13
Oracle Linux · 10 libwinpr 2:3.10.3-12.el10_2.13
Oracle Linux · 10 libwinpr-devel 2:3.10.3-12.el10_2.13

Vulnerabilities 1

  • Critical 9.3
    CVE-2026-91949

    FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

    FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive ne…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu