Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-27951 EUVD-2026-8755

FreeRDP has possible Integer overflow in Stream_EnsureCapacity

Published Feb 25, 2026 · Updated Feb 25, 2026 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.23.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.23.0+dfsg-1 —
Debian 13 freerdp3 No fix yet —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.26.04.1 USN-8561-1
Ubuntu 25.10 freerdp3 3.16.0+dfsg-2ubuntu0.3 USN-8105-1
Ubuntu 24.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.24.04.1 USN-8561-1, USN-8105-1
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS freerdp No fix yet —
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 freerdp +4 2:2.11.7-1.el9_7.7 RHSA-2026:19358, RHSA-2026:16482
RHEL 8 freerdp +4 2:2.11.7-9.el8_10 RHSA-2026:16019
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS freerdp +4 2:2.11.7-1.el9_6.10 RHSA-2026:16865
RHEL 9.4 EUS freerdp +4 2:2.11.2-1.el9_4.8 RHSA-2026:16866
RHEL 9.2 E4S freerdp +2 2:2.4.1-6.el9_2.9 RHSA-2026:16483
RHEL 9.0 E4S freerdp +2 2:2.4.1-3.el9_0.7 RHSA-2026:16485
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.8 RHSA-2026:16777
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.8 RHSA-2026:16777
RHEL 8.6 TUS freerdp +3 2:2.2.0-7.el8_6.8 RHSA-2026:16814
RHEL 8.6 E4S freerdp +3 2:2.2.0-7.el8_6.8 RHSA-2026:16814
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.8 RHSA-2026:16814
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-14.el8_4 RHSA-2026:19811
RHEL 8.4 AUS freerdp +3 2:2.2.0-14.el8_4 RHSA-2026:19811
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.9 RHSA-2026:20546

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 freerdp +4 2:2.11.7-1.el9_7.7 ALSA-2026:19358, ALSA-2026:16482
AlmaLinux 8 freerdp +4 2:2.11.7-9.el8_10 ALSA-2026:16019

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 freerdp +5 2:3.28.0-4.el10_3 RLSA-2026:97219
Rocky Linux 9 freerdp 2:2.11.7-1.el9_7.7 RLSA-2026:19358, RLSA-2026:16482
Rocky Linux 8 freerdp 2:2.11.7-9.el8_10 RLSA-2026:16019

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 freerdp 3.10.3-150700.3.17.1 SUSE-SU-2026:3562-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp2 2.11.7-8.1 openSUSE-SU-2026:10611-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.6.3-1.amzn2023.0.7 ALAS2023-2026-1512
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.8 ALAS2-2026-3221

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 freerdp +4 2:2.11.7-1.el9_7.7 ELSA-2026-19358, ELSA-2026-16482
Oracle Linux 8 freerdp +4 2:2.11.7-9.el8_10 ELSA-2026-16019
Oracle Linux 7 freerdp +4 2.1.1-5.0.9.el7_9 ELSA-2026-20546

Advisories 29

References