Skip to content
OpenAdvisories
High RHSA-2026:98508 3 CVEs

Red Hat Security Advisory: freerdp security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-debugsource 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream freerdp-libs-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libwinpr-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-debugsource 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-devel 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb freerdp-libs-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-debuginfo 2:2.11.7-13.el9_9.3
Red Hat · RHEL 9 enterprise_linux:9::crb libwinpr-devel 2:2.11.7-13.el9_9.3

Vulnerabilities 3

  • High 7.4
    CVE-2026-111880

    FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

    FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-109242

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequ…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.1
    CVE-2026-110837

    FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding

    FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2549790
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552978
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2554625
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98508.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-109242
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109242
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109242
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8
  • article
    https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade
  • report
    https://access.redhat.com/security/cve/CVE-2026-110837
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110837
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110837
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv
  • article
    https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding
  • report
    https://access.redhat.com/security/cve/CVE-2026-111880
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111880
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111880
  • article
    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67
  • article
    https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset