Skip to content
OpenAdvisories
Critical RHSA-2026:58710 4 CVEs

Red Hat Security Advisory: freerdp security update

Published Aug 24, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream freerdp 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream freerdp-debuginfo 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream freerdp-debugsource 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream freerdp-libs 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream freerdp-libs-debuginfo 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream libwinpr 2:2.11.2-1.el9_4.10
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream libwinpr-debuginfo 2:2.11.2-1.el9_4.10

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-67289

    FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.8
    CVE-2026-64624

    FreeRDP RDP File Parser Remote Code Execution via CLI Options

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67299

    FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-68580

    FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503096
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509985
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510125
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58710.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-64624
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64624
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64624
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m
  • article
    https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options
  • report
    https://access.redhat.com/security/cve/CVE-2026-67289
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67289
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67289
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm
  • article
    https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection
  • report
    https://access.redhat.com/security/cve/CVE-2026-67299
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67299
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67299
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3
  • article
    https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message
  • report
    https://access.redhat.com/security/cve/CVE-2026-68580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68580
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x
  • article
    https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel