Skip to content
OpenAdvisories
High ELSA-2026-8458 2 CVEs

Important: freerdp security update (Oracle Linux 10)

Published Apr 16, 2026 · Updated Apr 16, 2026

Ecosystem: Oracle Linux

Summary

[2:3.10.3-5.6]
- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
Resolves: RHEL-162946, RHEL-162962

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 10 freerdp 2:3.10.3-5.el10_1.6
Oracle Linux · 10 freerdp-devel 2:3.10.3-5.el10_1.6
Oracle Linux · 10 freerdp-libs 2:3.10.3-5.el10_1.6
Oracle Linux · 10 freerdp-server 2:3.10.3-5.el10_1.6
Oracle Linux · 10 libwinpr 2:3.10.3-5.el10_1.6
Oracle Linux · 10 libwinpr-devel 2:3.10.3-5.el10_1.6

Vulnerabilities 2

  • High 7.5
    CVE-2026-33984

    FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33983

    FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine