Skip to content
OpenAdvisories
Medium RHSA-2026:4433 2 CVEs

Red Hat Security Advisory: freerdp security update

Published Mar 13, 2026 · Updated Aug 19, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-debuginfo 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-debugsource 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-libs 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream freerdp-libs-debuginfo 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr-debuginfo 2:2.0.0-46.rc4.el8_2.7
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream libwinpr-devel 2:2.0.0-46.rc4.el8_2.7

Vulnerabilities 2

  • Medium 5.6
    CVE-2026-22858

    FreeRDP has a global-buffer-overflow in crypto_base64_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi
  • Medium 5.6
    CVE-2026-22859

    FreeRDP has a heap-buffer-overflow in urb_select_configuration

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429653
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4433.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-22858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22858
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
  • report
    https://access.redhat.com/security/cve/CVE-2026-22859
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22859
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22859
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36