Skip to content
OpenAdvisories
High RHSA-2026:61378 13 CVEs

Red Hat Security Advisory: freerdp security update

Published Sep 1, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-debuginfo 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-debugsource 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-devel 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-libs 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-libs-debuginfo 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-server 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 freerdp-server-debuginfo 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr-debuginfo 2:3.10.3-12.el10_2.10
Red Hat · RHEL 10 enterprise_linux:10.2 libwinpr-devel 2:3.10.3-12.el10_2.10

Vulnerabilities 13

  • High 8.7
    CVE-2026-55194

    FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.3
    CVE-2026-73241

    FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTH…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.3
    CVE-2026-73242

    FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV poi…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.7
    CVE-2026-63633

    FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-suppl…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67288

    FreeRDP before 3.29.0 Denial of Service via smartcard cache

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67291

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67296

    FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

    FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared bod…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67297

    FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

    FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67298

    FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67301

    FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67304

    FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-63652

    FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or n…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.4
    CVE-2026-69159 Rejected

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509986
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509994
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510001
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510010
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510029
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510034
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510041
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514346
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514349
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519822
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519824
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519826
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519828
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61378.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-55194
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55194
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55194
  • article
    https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12873
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx
  • report
    https://access.redhat.com/security/cve/CVE-2026-63633
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63633
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63633
  • article
    https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12993
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq
  • report
    https://access.redhat.com/security/cve/CVE-2026-63652
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63652
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63652
  • article
    https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9g22-w2gr-vcmp
  • report
    https://access.redhat.com/security/cve/CVE-2026-67288
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67288
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67288
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f