Skip to content
OpenAdvisories
High RHSA-2026:8945 2 CVEs

Red Hat Security Advisory: freerdp security update

Published Apr 21, 2026 · Updated Oct 7, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream freerdp 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream freerdp-debuginfo 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream freerdp-debugsource 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream freerdp-libs 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream freerdp-libs-debuginfo 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libwinpr 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libwinpr-debuginfo 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libwinpr-devel 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb freerdp-debuginfo 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb freerdp-debugsource 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb freerdp-devel 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb freerdp-libs-debuginfo 2:2.11.7-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb libwinpr-debuginfo 2:2.11.7-7.el8_10

Vulnerabilities 2

  • High 7.5
    CVE-2026-33984

    FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33983

    FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453219
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453220
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8945.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33983
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33983
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33983
  • article
    https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
  • report
    https://access.redhat.com/security/cve/CVE-2026-33984
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33984
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33984
  • article
    https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6