Skip to content
OpenAdvisories
High RHSA-2026:68707 7 CVEs

Red Hat Security Advisory: freerdp security update

Published Sep 18, 2026 · Updated Sep 30, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 freerdp 0:2.1.1-5.el7_9.12
Red Hat · RHEL 7 ELS rhel_els:7 freerdp-debuginfo 0:2.1.1-5.el7_9.12
Red Hat · RHEL 7 ELS rhel_els:7 freerdp-devel 0:2.1.1-5.el7_9.12
Red Hat · RHEL 7 ELS rhel_els:7 freerdp-libs 0:2.1.1-5.el7_9.12
Red Hat · RHEL 7 ELS rhel_els:7 libwinpr 0:2.1.1-5.el7_9.12
Red Hat · RHEL 7 ELS rhel_els:7 libwinpr-devel 0:2.1.1-5.el7_9.12

Vulnerabilities 7

  • High 8.7
    CVE-2026-55194

    FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-67288

    FreeRDP before 3.29.0 Denial of Service via smartcard cache

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67290

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

    FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by read…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67291

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67298

    FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67301

    FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.2
    CVE-2026-55192

    FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate re…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509984
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509994
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510001
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510010
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510041
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519823
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519824
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68707.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-55192
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55192
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55192
  • article
    https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12873
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6
  • report
    https://access.redhat.com/security/cve/CVE-2026-55194
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55194
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55194
  • article
    https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx
  • report
    https://access.redhat.com/security/cve/CVE-2026-67288
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67288
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67288
  • article
    https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
  • article
    https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3
  • article
    https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache
  • report
    https://access.redhat.com/security/cve/CVE-2026-67290
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67290
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67290
  • article
    https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8
  • article
    https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf
  • report
    https://access.redhat.com/security/cve/CVE-2026-67291
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67291
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67291
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6
  • article
    https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add