Skip to content
OpenAdvisories
Critical RHSA-2026:19033 23 CVEs

Red Hat Security Advisory: freerdp security update

Published May 20, 2026 · Updated Oct 7, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-debuginfo 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-debugsource 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-devel 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-libs 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-libs-debuginfo 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-server 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-server-debuginfo 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr-debuginfo 2:3.10.3-12.el10_2.2
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr-devel 2:3.10.3-12.el10_2.2

Vulnerabilities 23

  • Critical 9.3
    CVE-2026-31806

    FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values pr…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-26955

    FreeRDP has Out-of-bounds Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface co…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-26965

    FreeRDP has Out-of-bounds Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+n…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24678

    FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fix…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24679

    FreeRDP has a heap-buffer-overflow in urb_select_interface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerabilit…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24681

    FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is f…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24682

    FreeRDP has a Heap-buffer-overflow in audio_formats_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24683

    FreeRDP has a heap-use-after-free in ainput_send_input_event

    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24684

    FreeRDP has a Heap-use-after-free in play_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerab…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24491

    FreeRDP has a heap-use-after-free in video_timer

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.2…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24675

    FreeRDP has a Heap-use-after-free in urb_select_interface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerabili…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24676

    FreeRDP has a heap-use-after-free in audio_format_compatible

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vuln…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-33984

    FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2026-23948

    FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cb…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-22852

    FreeRDP has a heap-buffer-overflow in audin_process_formats

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->fo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 6.8
    CVE-2026-22853

    FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow i…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine Wolfi
  • Medium 6.8
    CVE-2026-22854

    FreeRDP has a heap-buffer-overflow in drive_process_irp_read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 6.8
    CVE-2026-22856

    FreeRDP has a heap-use-after-free in create_irp_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 6.5
    CVE-2026-33983

    FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.6
    CVE-2026-22855

    FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2026-23732

    FreeRDP has heap-buffer-overflow in Glyph_Alloc

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global b…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429645
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429647
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429650
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429652
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429653
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430881
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438197
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438201
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438202
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438208
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438212
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438216
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438221
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442959
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2443132
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447376
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453219
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453220
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19033.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-22852
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22852
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22852
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4
  • report
    https://access.redhat.com/security/cve/CVE-2026-22853
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22853
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22853
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch
  • report
    https://access.redhat.com/security/cve/CVE-2026-22854
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22854
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22854
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf
  • report
    https://access.redhat.com/security/cve/CVE-2026-22855