Skip to content
OpenAdvisories
Medium RLSA-2026:19142 10 CVEs

Moderate: freerdp security update

Published May 29, 2026 · Updated May 29, 2026

Ecosystem: Rocky Linux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 freerdp 2:3.10.3-12.el10_2.5

Vulnerabilities 10

  • High 7.1
    CVE-2026-33982

    FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.1
    CVE-2026-33987

    FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflat…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31883

    FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31884

    FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_s…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-31885

    FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-33985

    FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25952

    FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25997

    FreeRDP has heap-use-after-free in xf_clipboard_format_equal

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-26986

    FreeRDP has heap-use-after-free in rail_window_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-29775

    FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CAC…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442764
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447386
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447385
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453218