Skip to content
OpenAdvisories
High RLSA-2026:75570 11 CVEs

Important: freerdp security update

Published Oct 6, 2026 · Updated Oct 6, 2026

Ecosystem: Rocky Linux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)

* FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)

* FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)

* FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)

* FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)

* FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)

* FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)

* FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)

* FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)

* FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)

* FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 freerdp 2:3.10.3-12.el10_2.14

Vulnerabilities 11

  • High 8.8
    CVE-2026-91964

    FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-91947

    FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

    FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-85089

    FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

    FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91946

    FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

    FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory includ…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91950

    FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFF…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91953

    FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91954

    FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

    FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91956

    FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGUR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91959

    FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91960

    FreeRDP before 3.31.0 Integer Overflow Double Free

    FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended p…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-91963

    FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and e…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2527811
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533906
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533911
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533913
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533927
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533930
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533942
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533951
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533954
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533957
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533959
  • advisory
    https://access.redhat.com/errata/RHSA-2026:75570