Skip to content
OpenAdvisories
Critical RHSA-2026:60173 4 CVEs

Red Hat Security Advisory: freerdp security update

Published Aug 26, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-debugsource 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-libs 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freerdp-libs-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream libwinpr-devel 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-debugsource 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-libs 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream freerdp-libs-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr-debuginfo 2:2.2.0-14.el8_4.2
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream libwinpr-devel 2:2.2.0-14.el8_4.2

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-67289

    FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.8
    CVE-2026-64624

    FreeRDP RDP File Parser Remote Code Execution via CLI Options

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67299

    FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-68580

    FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503096
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509985
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510125
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60173.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-64624
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64624
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64624
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m
  • article
    https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options
  • report
    https://access.redhat.com/security/cve/CVE-2026-67289
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67289
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67289
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm
  • article
    https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection
  • report
    https://access.redhat.com/security/cve/CVE-2026-67299
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67299
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67299
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3
  • article
    https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message
  • report
    https://access.redhat.com/security/cve/CVE-2026-68580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68580
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x
  • article
    https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel