Red Hat Security Advisory

RHSA-2026:54485

freerdp security update

Released 2026-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) freerdp-2:2.11.7-11.el8_10, freerdp-libs-2:2.11.7-11.el8_10, libwinpr-2:2.11.7-11.el8_10 +1
Red Hat Enterprise Linux CRB (v. 8) freerdp-devel-2:2.11.7-11.el8_10

Fixes 4 records

TI-2026-47595 CVE-2026-67299 · GHSA-jq8c-588g-4wgj

FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

HIGH 77

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00398 Published 2026-08-01 Partial fix · 3.29.0 CWE-416

TI-2026-47585 CVE-2026-67289 · GHSA-3x8f-6ffv-v2wc

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

MEDIUM 48

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00428 Published 2026-08-01 Partial fix · 3.29.0 CWE-113

TI-2026-46185 CVE-2026-64624 · GHSA-4vxc-ggfg-5366

FreeRDP RDP File Parser Remote Code Execution via CLI Options

LOW 38

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.0018 Published 2026-07-20 Partial fix · 3.28.0 CWE-88

TI-2026-48320 CVE-2026-68580 · GHSA-mj63-24h6-p8wq

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

LOW 35

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RD…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00299 Published 2026-08-02 Partial fix · 3.29.0 CWE-122