Red Hat Security Advisory

RHSA-2026:54486

freerdp security update

Released 2026-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) freerdp-2:3.10.3-12.el10_2.8, freerdp-libs-2:3.10.3-12.el10_2.8, libwinpr-2:3.10.3-12.el10_2.8
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) freerdp-devel-2:3.10.3-12.el10_2.8, freerdp-server-2:3.10.3-12.el10_2.8, libwinpr-devel-2:3.10.3-12.el10_2.8

Fixes 6 records

TI-2026-47595 CVE-2026-67299 · GHSA-jq8c-588g-4wgj

FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

HIGH 77

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00398 Published 2026-08-01 Partial fix · 3.29.0 CWE-416

TI-2026-46182 CVE-2026-64621 · GHSA-7pv2-4c55-cg52

FreeRDP before 3.28.0 Double-Free via selectedmonitors

HIGH 73

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00363 Published 2026-07-20 Partial fix · 3.28.0 CWE-415

TI-2026-46181 CVE-2026-64620 · GHSA-xmhx-cqxp-qrgq

FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

MEDIUM 50

FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00913 Published 2026-07-20 Partial fix · 3.28.0 CWE-122

TI-2026-47585 CVE-2026-67289 · GHSA-3x8f-6ffv-v2wc

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

MEDIUM 48

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00428 Published 2026-08-01 Partial fix · 3.29.0 CWE-113

TI-2026-46185 CVE-2026-64624 · GHSA-4vxc-ggfg-5366

FreeRDP RDP File Parser Remote Code Execution via CLI Options

LOW 38

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.0018 Published 2026-07-20 Partial fix · 3.28.0 CWE-88

TI-2026-48320 CVE-2026-68580 · GHSA-mj63-24h6-p8wq

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

LOW 35

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RD…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00299 Published 2026-08-02 Partial fix · 3.29.0 CWE-122