Skip to content
OpenAdvisories
High RHSA-2026:16014 10 CVEs

Red Hat Security Advisory: freerdp security update

Published May 12, 2026 · Updated Oct 7, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-debuginfo 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-debugsource 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-devel 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-libs 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-libs-debuginfo 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-server 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-server-debuginfo 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr-debuginfo 2:3.10.3-5.el10_1.8
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr-devel 2:3.10.3-5.el10_1.8

Vulnerabilities 10

  • High 7.1
    CVE-2026-33982

    FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.1
    CVE-2026-33987

    FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflat…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31883

    FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31884

    FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_s…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31885

    FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-33985

    FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25952

    FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25997

    FreeRDP has heap-use-after-free in xf_clipboard_format_equal

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-26986

    FreeRDP has heap-use-after-free in rail_window_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-29775

    FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CAC…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442764
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447385
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447386
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453226
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16014.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-25952
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-25952
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-25952
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428
  • article
    https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
  • report
    https://access.redhat.com/security/cve/CVE-2026-25997
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-25997
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-25997
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1884
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1889
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L265
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L616
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L831
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L851-L855
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L868-L875
  • article
    https://github.com/FreeRDP/FreeRDP/commit/58409406afe7c2a8a71ed2dc8e22075be4f41c0c
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5j3-m6jf-3jq4
  • report
    https://access.redhat.com/security/cve/CVE-2026-26986