Skip to content
OpenAdvisories
High ELSA-2026-8457 2 CVEs

Important: freerdp security update (Oracle Linux 9)

Published Apr 16, 2026 · Updated Apr 16, 2026

Ecosystem: Oracle Linux

Summary

[2:2.11.7-1.6]
- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
Resolves: RHEL-162958, RHEL-162978

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 freerdp 2:2.11.7-1.el9_7.6
Oracle Linux · 9 freerdp-devel 2:2.11.7-1.el9_7.6
Oracle Linux · 9 freerdp-libs 2:2.11.7-1.el9_7.6
Oracle Linux · 9 libwinpr 2:2.11.7-1.el9_7.6
Oracle Linux · 9 libwinpr-devel 2:2.11.7-1.el9_7.6

Vulnerabilities 2

  • High 7.5
    CVE-2026-33984

    FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33983

    FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine