Skip to content
OpenAdvisories
High RHSA-2026:61379 4 CVEs

Red Hat Security Advisory: freerdp security update

Published Sep 1, 2026 · Updated Sep 30, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debugsource 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debugsource 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-devel 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-libs-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-debuginfo 2:2.11.7-7.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-devel 2:2.11.7-7.el9_8.6

Vulnerabilities 4

  • High 8.7
    CVE-2026-55194

    FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-67288

    FreeRDP before 3.29.0 Denial of Service via smartcard cache

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67291

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67301

    FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509994
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510001
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510010
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519824
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61379.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-55194
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55194
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55194
  • article
    https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12873
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx
  • report
    https://access.redhat.com/security/cve/CVE-2026-67288
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67288
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67288
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3
  • article
    https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache
  • report
    https://access.redhat.com/security/cve/CVE-2026-67291
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67291
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67291
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6
  • article
    https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add
  • report
    https://access.redhat.com/security/cve/CVE-2026-67301
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67301
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67301
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w
  • article
    https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxy