Skip to content
OpenAdvisories
High ELSA-2026-94510 3 CVEs

Important: freerdp security update (Oracle Linux 8)

Published Nov 3, 2026 · Updated Nov 3, 2026

Ecosystem: Oracle Linux

Summary

[2:2.11.7-15]
- Backport several CVE fixes (CVE-2026-109242, CVE-2026-110837,
CVE-2026-111880)
Resolves: RHEL-282289, RHEL-283715, RHEL-286595

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 8 freerdp 2:2.11.7-15.el8_10
Oracle Linux · 8 freerdp-devel 2:2.11.7-15.el8_10
Oracle Linux · 8 freerdp-libs 2:2.11.7-15.el8_10
Oracle Linux · 8 libwinpr 2:2.11.7-15.el8_10
Oracle Linux · 8 libwinpr-devel 2:2.11.7-15.el8_10

Vulnerabilities 3

  • High 7.4
    CVE-2026-111880

    FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

    FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-109242

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequ…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-110837

    FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding

    FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu