Skip to content
OpenAdvisories
Medium RHSA-2026:16865 8 CVEs

Red Hat Security Advisory: freerdp security update

Published May 13, 2026 · Updated Oct 7, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream freerdp 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream freerdp-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream freerdp-debugsource 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream freerdp-libs 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream freerdp-libs-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream libwinpr 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream libwinpr-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb freerdp-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb freerdp-debugsource 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb freerdp-devel 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb freerdp-libs-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb libwinpr-debuginfo 2:2.11.7-1.el9_6.10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb libwinpr-devel 2:2.11.7-1.el9_6.10

Vulnerabilities 8

  • Medium 6.5
    CVE-2026-31883

    FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31884

    FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_s…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31885

    FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-33985

    FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25952

    FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-26986

    FreeRDP has heap-use-after-free in rail_window_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-27951

    FreeRDP has possible Integer overflow in Stream_EnsureCapacity

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitati…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-29775

    FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CAC…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442783
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447385
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447386
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453217
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16865.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-25952
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-25952
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-25952
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428
  • article
    https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
  • report
    https://access.redhat.com/security/cve/CVE-2026-26986
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-26986
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-26986
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399
  • article
    https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404
  • article
    https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47
  • report
    https://access.redhat.com/security/cve/CVE-2026-27951
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-27951
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-27951
  • article
    https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927