Skip to content
OpenAdvisories
High RHSA-2026:3068 5 CVEs

Red Hat Security Advisory: freerdp security update

Published Feb 24, 2026 · Updated Aug 19, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-debuginfo 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-debugsource 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-devel 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-libs 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-libs-debuginfo 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-server 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 freerdp-server-debuginfo 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr-debuginfo 2:3.10.3-5.el10_1.2
Red Hat · RHEL 10 enterprise_linux:10.1 libwinpr-devel 2:3.10.3-5.el10_1.2

Vulnerabilities 5

  • High 8.7
    CVE-2026-24678

    FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fix…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-22853

    FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow i…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22855

    FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429645
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429647
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429653
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438197
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3068.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-22853
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22853
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22853
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch
  • report
    https://access.redhat.com/security/cve/CVE-2026-22855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22855
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22855
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9
  • report
    https://access.redhat.com/security/cve/CVE-2026-22858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22858
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
  • report
    https://access.redhat.com/security/cve/CVE-2026-22859
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22859
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22859
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36
  • report
    https://access.redhat.com/security/cve/CVE-2026-24678
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24678
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24678
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3ab1a16139036179d9852745fdade18fec11600
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6gvg-29wx-6v7h