Skip to content
OpenAdvisories
High ELSA-2026-76755 6 CVEs

Important: freerdp security update (Oracle Linux 9)

Published Oct 7, 2026 · Updated Oct 7, 2026

Ecosystem: Oracle Linux

Summary

[2:2.11.7-7.8]
- Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956,
CVE-2026-91959, CVE-2026-91963, CVE-2026-91964)
Resolves: RHEL-260758, RHEL-260785, RHEL-260803, RHEL-260849, RHEL-260871
Resolves: RHEL-260902

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 freerdp 2:2.11.7-7.el9_8.8
Oracle Linux · 9 freerdp-devel 2:2.11.7-7.el9_8.8
Oracle Linux · 9 freerdp-libs 2:2.11.7-7.el9_8.8
Oracle Linux · 9 libwinpr 2:2.11.7-7.el9_8.8
Oracle Linux · 9 libwinpr-devel 2:2.11.7-7.el9_8.8

Vulnerabilities 6

  • High 8.8
    CVE-2026-91964

    FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91953

    FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91954

    FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

    FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91956

    FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGUR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91959

    FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91963

    FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and e…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu