Skip to content
OpenAdvisories
Critical RHSA-2026:10734 9 CVEs

Red Hat Security Advisory: freerdp security update

Published Apr 27, 2026 · Updated Aug 19, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-debuginfo 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-debugsource 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-libs 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-libs-debuginfo 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr-debuginfo 2:2.0.0-46.rc4.el8_2.10
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr-devel 2:2.0.0-46.rc4.el8_2.10

Vulnerabilities 9

  • Critical 9.3
    CVE-2026-31806

    FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values pr…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24679

    FreeRDP has a heap-buffer-overflow in urb_select_interface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerabilit…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24491

    FreeRDP has a heap-use-after-free in video_timer

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.2…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24676

    FreeRDP has a heap-use-after-free in audio_format_compatible

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vuln…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2026-23948

    FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cb…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-22852

    FreeRDP has a heap-buffer-overflow in audin_process_formats

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->fo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 6.8
    CVE-2026-22854

    FreeRDP has a heap-buffer-overflow in drive_process_irp_read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 6.8
    CVE-2026-22856

    FreeRDP has a heap-use-after-free in create_irp_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2026-23732

    FreeRDP has heap-buffer-overflow in Glyph_Alloc

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global b…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429650
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429652
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430881
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438201
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438202
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447376
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10734.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-22852
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22852
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22852
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4
  • report
    https://access.redhat.com/security/cve/CVE-2026-22854
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22854
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22854
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf
  • report
    https://access.redhat.com/security/cve/CVE-2026-22856
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22856
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22856
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv
  • report
    https://access.redhat.com/security/cve/CVE-2026-23732
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23732
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23732
  • article
    https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/cache/glyph.c#L463-L480
  • article
    https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/codec/color.c#L261-L277
  • article
    https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/graphics.c#L138
  • article
    https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/orders.c#L2186C17-L2199
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp
  • report
    https://access.redhat.com/security/cve/CVE-2026-23948
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23948
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23948
  • article
    https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6f3c-qvqq-2px5
  • report
    https://access.redhat.com/security/cve/CVE-2026-24491