Skip to content
OpenAdvisories
Critical RHSA-2026:58711 6 CVEs

Red Hat Security Advisory: freerdp security update

Published Aug 24, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-debuginfo 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-debugsource 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-devel 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-libs 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-libs-debuginfo 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-server 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-server-debuginfo 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr-debuginfo 2:3.10.3-3.el10_0.11
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr-devel 2:3.10.3-3.el10_0.11

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-64620

    FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

    FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward check…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2026-67289

    FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.8
    CVE-2026-64624

    FreeRDP RDP File Parser Remote Code Execution via CLI Options

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67299

    FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-68580

    FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.3
    CVE-2026-64621

    FreeRDP before 3.28.0 Double-Free via selectedmonitors

    FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502752
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502766
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503096
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509985
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510125
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58711.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-64620
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64620
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64620
  • article
    https://github.com/FreeRDP/FreeRDP/commit/1f7a716d39b5605bb8a83b0c3c97a6ce386609ef
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc
  • article
    https://www.vulncheck.com/advisories/freerdp-before-heap-buffer-overflow-via-crypto-rsa-common
  • report
    https://access.redhat.com/security/cve/CVE-2026-64621
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64621
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64621
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc
  • article
    https://www.vulncheck.com/advisories/freerdp-before-double-free-via-selectedmonitors
  • report
    https://access.redhat.com/security/cve/CVE-2026-64624
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64624
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64624
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m
  • article
    https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options
  • report
    https://access.redhat.com/security/cve/CVE-2026-67289
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67289
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67289
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm
  • article
    https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection
  • report
    https://access.redhat.com/security/cve/CVE-2026-67299
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67299
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67299
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3
  • article
    https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message
  • report
    https://access.redhat.com/security/cve/CVE-2026-68580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68580