Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FreeRDP | FreeRDP | < 3.24.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freerdp3 | 3.24.0+dfsg-1 | — |
| Debian 13 | freerdp3 | 3.15.0+dfsg-2.1+deb13u2 | — |
| Debian 12 | freerdp2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | USN-8561-1 |
| Ubuntu 25.10 | freerdp3 | No fix yet | — |
| Ubuntu 24.04 LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | USN-8561-1 |
| Ubuntu 22.04 LTS | freerdp2 | No fix yet | — |
| Ubuntu 18.04 LTS | freerdp | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | freerdp | No fix yet | — |
| Ubuntu Pro 24.04 LTS | freerdp2 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | freerdp2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | freerdp2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | freerdp +5 | 2:3.10.3-5.el10_1.5 | RHSA-2026:19033, RHSA-2026:6799 |
| RHEL 9 | freerdp +4 | 2:2.11.7-1.el9_7.5 | RHSA-2026:6340 |
| RHEL 8 | freerdp +4 | 2:2.11.7-6.el8_10 | RHSA-2026:6918 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | freerdp +5 | 2:3.10.3-3.el10_0.5 | RHSA-2026:6743 |
| RHEL 9.6 EUS | freerdp +4 | 2:2.11.7-1.el9_6.7 | RHSA-2026:6727 |
| RHEL 9.4 EUS | freerdp +4 | 2:2.11.2-1.el9_4.5 | RHSA-2026:6958 |
| RHEL 9.2 E4S | freerdp +2 | 2:2.4.1-6.el9_2.6 | RHSA-2026:9641 |
| RHEL 9.0 E4S | freerdp +2 | 2:2.4.1-3.el9_0.4 | RHSA-2026:9640 |
| RHEL 8.8 TUS | freerdp +3 | 2:2.2.0-12.el8_8.5 | RHSA-2026:10076 |
| RHEL 8.8 E4S | freerdp +3 | 2:2.2.0-12.el8_8.5 | RHSA-2026:10076 |
| RHEL 8.6 TUS | freerdp +3 | 2:2.2.0-7.el8_6.5 | RHSA-2026:10951 |
| RHEL 8.6 E4S | freerdp +3 | 2:2.2.0-7.el8_6.5 | RHSA-2026:10951 |
| RHEL 8.6 AUS | freerdp +3 | 2:2.2.0-7.el8_6.5 | RHSA-2026:10951 |
| RHEL 8.4 EUS Long Life | freerdp +3 | 2:2.2.0-12.el8_4 | RHSA-2026:10735 |
| RHEL 8.4 AUS | freerdp +3 | 2:2.2.0-12.el8_4 | RHSA-2026:10735 |
| RHEL 8.2 AUS | freerdp +3 | 2:2.0.0-46.rc4.el8_2.10 | RHSA-2026:10734 |
| RHEL 7 ELS | freerdp +4 | 2.1.1-5.el7_9.7 | RHSA-2026:11323 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | freerdp +5 | 2:3.10.3-5.el10_1.5 | ALSA-2026:6799 |
| AlmaLinux 9 | freerdp +4 | 2:2.11.7-1.el9_7.5 | ALSA-2026:6340 |
| AlmaLinux 8 | freerdp +4 | 2:2.11.7-6.el8_10 | ALSA-2026:6918 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | freerdp | 2:3.10.3-5.el10_1.5 | RLSA-2026:6799 |
| Rocky Linux 9 | freerdp | 2:2.11.7-1.el9_7.5 | RLSA-2026:6340 |
| Rocky Linux 8 | freerdp | 2:2.11.7-6.el8_10 | RLSA-2026:6918 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | freerdp | 2.4.0-150400.3.47.1 | SUSE-SU-2026:1398-1, SUSE-SU-2026:1160-1, SUSE-SU-2026:1129-1 |
| SLES 15 SP7 | freerdp2 | 2.11.7-150700.3.14.1 | SUSE-SU-2026:1164-1 |
| SLES 12 SP5 | freerdp | 2.1.2-12.63.1 | SUSE-SU-2026:1165-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freerdp | 3.24.1-1.1 | openSUSE-SU-2026:10408-1 |
| openSUSE Tumbleweed | freerdp2 | 2.11.7-6.1 | openSUSE-SU-2026:10459-1 |
| openSUSE Leap 15.6 | freerdp | 2.11.2-150600.4.18.1 | SUSE-SU-2026:1160-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | freerdp | 3.24.0-r0 | — |
| Alpine v3.23 | freerdp | 3.24.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | freerdp +5 | 2:3.6.3-1.amzn2023.0.7 | ALAS2023-2026-1512 |
| Amazon Linux 2 | freerdp +4 | 2:2.11.7-1.amzn2.0.8 | ALAS2-2026-3221 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | freerdp +5 | 2:3.10.3-5.el10_1.5 | ELSA-2026-19033, ELSA-2026-6799 |
| Oracle Linux 9 | freerdp +4 | 2:2.11.7-1.el9_7.5 | ELSA-2026-6340 |
| Oracle Linux 8 | freerdp +4 | 2:2.11.7-6.el8_10 | ELSA-2026-6918 |
| Oracle Linux 7 | freerdp +4 | 2.1.1-5.0.7.el7_9 | ELSA-2026-11323 |
Advisories 36
- ALSA-2026:6799 Important: freerdp security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:6340 Important: freerdp security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:6918 Important: freerdp security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:19033 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- USN-8561-1 freerdp3 vulnerabilities Ubuntu Security Notices (USN) · Oct 1, 2026
- WID-SEC-2026-0725 FreeRDP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2026
- RHSA-2026:9641 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:9640 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6958 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6918 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6743 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6799 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6727 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:6340 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:11323 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:10951 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:10735 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:10734 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2026:10076 Red Hat Security Advisory: freerdp security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- ELSA-2026-19033 Important: freerdp security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-11323 Important: freerdp security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 9, 2026
- SUSE-SU-2026:1398-1 Security update for freerdp SUSE / openSUSE Security Updates · Apr 17, 2026
- RLSA-2026:6799 Important: freerdp security update Rocky Linux Security Advisories · Apr 9, 2026
- RLSA-2026:6918 Important: freerdp security update Rocky Linux Security Advisories · Apr 9, 2026
- RLSA-2026:6340 Important: freerdp security update Rocky Linux Security Advisories · Apr 7, 2026
- ELSA-2026-6799 Important: freerdp security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 7, 2026
- ELSA-2026-6918 Important: freerdp security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 7, 2026
- SUSE-SU-2026:1165-1 Security update for freerdp SUSE / openSUSE Security Updates · Apr 3, 2026
- SUSE-SU-2026:1164-1 Security update for freerdp2 SUSE / openSUSE Security Updates · Apr 3, 2026
- ALAS2023-2026-1512 Important: freerdp security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 1, 2026
- ALAS2-2026-3221 Important: freerdp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 1, 2026
- SUSE-SU-2026:1160-1 Security update for freerdp SUSE / openSUSE Security Updates · Apr 1, 2026
- ELSA-2026-6340 Important: freerdp security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 1, 2026
- openSUSE-SU-2026:10459-1 freerdp2-2.11.7-6.1 on GA media SUSE / openSUSE Security Updates · Mar 30, 2026
- SUSE-SU-2026:1129-1 Security update for freerdp SUSE / openSUSE Security Updates · Mar 29, 2026
- openSUSE-SU-2026:10408-1 freerdp-3.24.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 24, 2026