Skip to content
OpenAdvisories
Medium · 5.6 CVE-2026-22855 EUVD-2026-2672

FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

Published Jan 14, 2026 · Updated Aug 19, 2026 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp Package: freerdp-dev Package: freerdp-libs Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.20.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.20.2+dfsg-1 —
Debian 13 freerdp3 3.15.0+dfsg-2.1+deb13u1 —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freerdp3 3.20.2+dfsg-1 —
Ubuntu 25.10 freerdp3 3.16.0+dfsg-2ubuntu0.3 USN-8105-1
Ubuntu 24.04 LTS freerdp3 3.5.1+dfsg1-0ubuntu1.4 USN-8105-1
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS freerdp No fix yet —
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 freerdp +5 2:3.10.3-5.el10_1.2 RHSA-2026:19033, RHSA-2026:3068
RHEL 9 freerdp +4 2:2.11.7-1.el9_7.2 RHSA-2026:3067
RHEL 8 freerdp +4 2:2.11.7-3.el8_10 RHSA-2026:3334
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS freerdp +5 2:3.10.3-3.el10_0.2 RHSA-2026:4121
RHEL 9.6 EUS freerdp +4 2:2.11.7-1.el9_6.2 RHSA-2026:3975
RHEL 9.4 EUS freerdp +4 2:2.11.2-1.el9_4.2 RHSA-2026:4438
RHEL 9.2 E4S freerdp +2 2:2.4.1-6.el9_2.3 RHSA-2026:4437
RHEL 9.0 E4S freerdp +2 2:2.4.1-3.el9_0.1 RHSA-2026:4489
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.2 RHSA-2026:4440
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.2 RHSA-2026:4440
RHEL 8.6 TUS freerdp +3 2:2.2.0-7.el8_6.2 RHSA-2026:4446
RHEL 8.6 E4S freerdp +3 2:2.2.0-7.el8_6.2 RHSA-2026:4446
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.2 RHSA-2026:4446
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-8.el8_4 RHSA-2026:4439
RHEL 8.4 AUS freerdp +3 2:2.2.0-8.el8_4 RHSA-2026:4439
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.2 RHSA-2026:4471

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 freerdp +5 2:3.10.3-5.el10_1.2 ALSA-2026:3068
AlmaLinux 9 freerdp +4 2:2.11.7-1.el9_7.2 ALSA-2026:3067
AlmaLinux 8 freerdp +4 2:2.11.7-3.el8_10 ALSA-2026:3334

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 freerdp 2:3.10.3-5.el10_1.2 RLSA-2026:3068
Rocky Linux 9 freerdp 2:2.11.7-1.el9_7.2 RLSA-2026:3067
Rocky Linux 8 freerdp 2:2.11.7-3.el8_10 RLSA-2026:3334

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 freerdp 2.4.0-150400.3.41.1 SUSE-SU-2026:0761-1, SUSE-SU-2026:0656-1, SUSE-SU-2026:0345-1
SLES 15 SP7 freerdp2 2.11.7-150700.3.8.1 SUSE-SU-2026:0683-1
SLES 12 SP5 freerdp 2.1.2-12.57.1 SUSE-SU-2026:0762-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp 3.20.2-1.1 openSUSE-SU-2026:10059-1
openSUSE Tumbleweed freerdp2 2.11.7-6.1 openSUSE-SU-2026:10459-1
openSUSE Leap 16.0 freerdp 3.22.0-160000.1.1 openSUSE-SU-2026:20339-1
openSUSE Leap 15.6 freerdp 2.11.2-150600.4.12.1 SUSE-SU-2026:0761-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.23 freerdp 3.22.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.6.3-1.amzn2023.0.3 ALAS2023-2026-1433
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.4 ALAS2-2026-3166

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 freerdp +5 2:3.10.3-5.el10_1.2 ELSA-2026-19033, ELSA-2026-3068
Oracle Linux 9 freerdp +4 2:2.11.7-1.el9_7.2 ELSA-2026-3067
Oracle Linux 8 freerdp +4 2:2.11.7-3.el8_10 ELSA-2026-3334
Oracle Linux 7 freerdp +4 2.1.1-5.0.3.el7_9 ELSA-2026-4471

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling freerdp-dev +1 No fix yet —

Advisories 36

References