Red Hat Security AdvisoryRHSA-2026:58711
freerdp security update
Released 2026-08-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) freerdp-2:3.10.3-3.el10_0.11, freerdp-libs-2:3.10.3-3.el10_0.11, libwinpr-2:3.10.3-3.el10_0.11
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) freerdp-devel-2:3.10.3-3.el10_0.11, freerdp-server-2:3.10.3-3.el10_0.11, libwinpr-devel-2:3.10.3-3.el10_0.11
Fixes 6 records
Priority HIGH 77
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00398 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-416
Priority HIGH 73
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00363 · Published 2026-07-20 · Partial fix · 3.28.0 CWE-415
Priority MEDIUM 50
FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c).
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00913 · Published 2026-07-20 · Partial fix · 3.28.0 CWE-122
Priority MEDIUM 48
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00428 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-113
Priority LOW 38
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files.
CVSS 4.0HIGH 8.5· Local · No auth · User interaction · EPSS 0.0018 · Published 2026-07-20 · Partial fix · 3.28.0 CWE-88
Priority LOW 35
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RD…
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00299 · Published 2026-08-02 · Partial fix · 3.29.0 CWE-122
THREATIST.IORead the docs