Skip to content
OpenAdvisories
High RHSA-2026:98469 7 CVEs

Red Hat Security Advisory: freerdp security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debugsource 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debugsource 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-devel 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-libs-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-debuginfo 2:2.11.7-13.el9_9.2
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-devel 2:2.11.7-13.el9_9.2

Vulnerabilities 7

  • High 8.8
    CVE-2026-91964

    FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.7
    CVE-2026-55193

    FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment alloca…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-91953

    FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91954

    FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

    FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91956

    FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGUR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91959

    FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91963

    FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and e…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533906
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533911
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533927
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533930
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533951
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533959
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98469.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-55193
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55193
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55193
  • article
    https://github.com/FreeRDP/FreeRDP/commit/a863ef1cf1cdabf9019280e5658f806e73bb50e8
  • article
    https://github.com/FreeRDP/FreeRDP/pull/12873
  • article
    https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rp4-66mc-j9vx
  • report
    https://access.redhat.com/security/cve/CVE-2026-91953
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91953
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91953
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6
  • article
    https://www.vulncheck.com/advisories/freerdp-before-3.31.0-heap-buffer-overflow-via-lb-load-balance-info
  • report
    https://access.redhat.com/security/cve/CVE-2026-91954
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91954
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91954
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch
  • article
    https://www.vulncheck.com/advisories/freerdp-before-3.31.0-null-pointer-dereference-via-nscodec
  • report
    https://access.redhat.com/security/cve/CVE-2026-91956
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91956
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91956
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8
  • article
    https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-urbdrc
  • report
    https://access.redhat.com/security/cve/CVE-2026-91959
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91959
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91959
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438
  • article
    https://www.vulncheck.com/advisories/freerdp-before-3.31.0-buffer-over-read-via-rts-gateway
  • report
    https://access.redhat.com/security/cve/CVE-2026-91963
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91963
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91963