Skip to content
OpenAdvisories
Medium RHSA-2026:3067 3 CVEs

Red Hat Security Advisory: freerdp security update

Published Feb 24, 2026 · Updated Aug 19, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debugsource 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debugsource 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-devel 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-libs-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-debuginfo 2:2.11.7-1.el9_7.2
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-devel 2:2.11.7-1.el9_7.2

Vulnerabilities 3

  • Medium 5.6
    CVE-2026-22855

    FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429645
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429653
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3067.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-22855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22855
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22855
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9
  • report
    https://access.redhat.com/security/cve/CVE-2026-22858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22858
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
  • report
    https://access.redhat.com/security/cve/CVE-2026-22859
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22859
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22859
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36