Skip to content
OpenAdvisories
Critical RHSA-2026:74471 2 CVEs

Red Hat Security Advisory: freerdp security update

Published Oct 2, 2026 · Updated Oct 3, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-debuginfo 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-debugsource 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-devel 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-libs 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-libs-debuginfo 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-server 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 freerdp-server-debuginfo 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr-debuginfo 2:3.10.3-3.el10_0.18
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libwinpr-devel 2:3.10.3-3.el10_0.18

Vulnerabilities 2

  • Critical 9.3
    CVE-2026-91949

    FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

    FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive ne…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 8.7
    CVE-2026-55193

    FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment alloca…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533925
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74471.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-55193
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55193
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55193
  • article
    https://github.com/FreeRDP/FreeRDP/commit/a863ef1cf1cdabf9019280e5658f806e73bb50e8
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12873
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rp4-66mc-j9vx
  • report
    https://access.redhat.com/security/cve/CVE-2026-91949
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91949
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91949
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
  • article
    https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass