Skip to content
OpenAdvisories
High RHSA-2026:2736 7 CVEs

Red Hat Security Advisory: freerdp security update

Published Feb 17, 2026 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream freerdp 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream freerdp-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream freerdp-debugsource 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream freerdp-libs 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream freerdp-libs-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream libwinpr 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream libwinpr-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb freerdp-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb freerdp-debugsource 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb freerdp-devel 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb freerdp-libs-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb libwinpr-debuginfo 2:2.11.2-1.el9_4.1
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb libwinpr-devel 2:2.11.2-1.el9_4.1

Vulnerabilities 7

  • High 7.7
    CVE-2026-23530

    FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23531

    FreeRDP has heap-buffer-overflow in clear_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bou…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23532

    FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual cop…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23533

    FreeRDP has heap-buffer-overflow in clear_decompress_residual_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23534

    FreeRDP has heap-buffer-overflow in clear_decompress_bands_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23883

    Heap-use-after-free in update_pointer_new

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23884

    Heap-use-after-free in gdi_set_bounds

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430877
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430880
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430885
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430886
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430888
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430891
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2736.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23530
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23530
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23530
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p
  • report
    https://access.redhat.com/security/cve/CVE-2026-23531
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23531
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23531
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L1139-L1145
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5
  • report
    https://access.redhat.com/security/cve/CVE-2026-23532
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23532
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23532
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/gdi/gfx.c#L1368-L1382
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr
  • report
    https://access.redhat.com/security/cve/CVE-2026-23533
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23533
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23533
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L268-L281
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L336
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v
  • report
    https://access.redhat.com/security/cve/CVE-2026-23534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23534
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L878-L879
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L883-L884
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3frr-mp8w-4599