Skip to content
OpenAdvisories
High RHSA-2026:3038 5 CVEs

Red Hat Security Advisory: freerdp security update

Published Feb 23, 2026 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-debugsource 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-libs 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-libs-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr-devel 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-debugsource 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-libs 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-libs-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr-debuginfo 2:2.2.0-7.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr-devel 2:2.2.0-7.el8_4

Vulnerabilities 5

  • High 7.7
    CVE-2026-23530

    FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23531

    FreeRDP has heap-buffer-overflow in clear_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bou…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23532

    FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual cop…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23533

    FreeRDP has heap-buffer-overflow in clear_decompress_residual_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • High 7.7
    CVE-2026-23884

    Heap-use-after-free in gdi_set_bounds

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430877
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430880
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430886
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430891
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3038.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23530
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23530
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23530
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p
  • report
    https://access.redhat.com/security/cve/CVE-2026-23531
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23531
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23531
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L1139-L1145
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5
  • report
    https://access.redhat.com/security/cve/CVE-2026-23532
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23532
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23532
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/gdi/gfx.c#L1368-L1382
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr
  • report
    https://access.redhat.com/security/cve/CVE-2026-23533
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23533
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23533
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L268-L281
  • article
    https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L336
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v
  • report
    https://access.redhat.com/security/cve/CVE-2026-23884
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23884
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23884
  • article
    https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L114-L122
  • article
    https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L87-L91
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp