Skip to content
OpenAdvisories
High · 8.8 CVE-2026-91964 EUVD-2026-78640GHSA-f73m-4rv5-6gp4

FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

Published Sep 15, 2026 · Updated Sep 16, 2026 · Assigned by VulnCheck

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP 2.0.0 – < 3.0.0, 3.0.0 – < 3.31.0, < 3.31.0 3.0.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.31.0+dfsg-1 —
Debian 13 freerdp3 No fix yet —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freerdp3 3.31.0+dfsg-0ubuntu0.26.04.1 —
Ubuntu 24.04 LTS freerdp3 3.31.0+dfsg-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 16.04 LTS freerdp No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 freerdp +5 2:3.10.3-12.el10_2.14 RHSA-2026:98598, RHSA-2026:75570
RHEL 9 freerdp +4 2:2.11.7-7.el9_8.8 RHSA-2026:98469, RHSA-2026:76755
RHEL 8 freerdp +4 2:2.11.7-14.el8_10 RHSA-2026:76747
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 E4S freerdp +2 2:2.11.2-1.el9_4.13 RHSA-2026:99034
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.13 RHSA-2026:93537
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.13 RHSA-2026:93537
RHEL 8.6 EUS Long Life freerdp +3 2:2.2.0-7.el8_6.14 RHSA-2026:93549
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.14 RHSA-2026:93549
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-14.el8_4.5 RHSA-2026:93538
RHEL 8.4 AUS freerdp +3 2:2.2.0-14.el8_4.5 RHSA-2026:93538
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.14 RHSA-2026:93559

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 freerdp +5 2:3.10.3-12.el10_2.14 ALSA-2026:75570
AlmaLinux 9 freerdp +4 2:2.11.7-7.el9_8.8 ALSA-2026:76755
AlmaLinux 8 freerdp +4 2:2.11.7-14.el8_10 ALSA-2026:76747

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 freerdp 2:3.10.3-12.el10_2.14 RLSA-2026:98598, RLSA-2026:75570
Rocky Linux 10 libwinpr +4 2:3.32.2-1.el10_2 RLSA-2026:98598
Rocky Linux 9 freerdp 2:2.11.7-7.el9_8.8 RLSA-2026:76755
Rocky Linux 8 freerdp 2:2.11.7-14.el8_10 RLSA-2026:76747

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.31.0-1.amzn2023 ALAS2023-2026-2142
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.16 ALAS2-2026-3938

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 freerdp +5 2:3.10.3-12.el10_2.14 ELSA-2026-75570
Oracle Linux 9 freerdp +4 2:2.11.7-7.el9_8.8 ELSA-2026-76755
Oracle Linux 8 freerdp +4 2:2.11.7-14.el8_10 ELSA-2026-76747

Advisories 23

References