Red Hat Security Advisory

RHSA-2026:61378

freerdp security update

Released 2026-08-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) freerdp-2:3.10.3-12.el10_2.10, freerdp-libs-2:3.10.3-12.el10_2.10, libwinpr-2:3.10.3-12.el10_2.10
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) freerdp-devel-2:3.10.3-12.el10_2.10, freerdp-server-2:3.10.3-12.el10_2.10, libwinpr-devel-2:3.10.3-12.el10_2.10

Fixes 12 records

TI-2026-47600 CVE-2026-67304 · GHSA-6x5p-r76q-h5g9

FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

HIGH 77

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00651 Published 2026-08-01 Fixed in 3.29.0 CWE-476

TI-2026-47597 CVE-2026-67301 · GHSA-vpv4-cm44-pgmc

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

HIGH 77

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00651 Published 2026-08-01 Fixed in 3.29.0 CWE-125

TI-2026-47594 CVE-2026-67298 · GHSA-wrfm-6x9r-42cr

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

HIGH 77

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c).

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00718 Published 2026-08-01 Partial fix · 3.29.0 CWE-191

TI-2026-47593 CVE-2026-67297 · GHSA-43rq-pv9m-43rf

FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

HIGH 77

FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body().

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-08-01 Fixed in 3.29.0 CWE-770

TI-2026-47592 CVE-2026-67296 · GHSA-xq3v-xj62-r99v

FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

HIGH 77

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-08-01 Fixed in 3.29.0 CWE-20

TI-2026-47587 CVE-2026-67291 · GHSA-qx25-fqx8-cgm7

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

HIGH 77

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0041 Published 2026-08-01 Partial fix · 3.29.0 CWE-125

TI-2026-47584 CVE-2026-67288 · GHSA-hq8h-rvcv-jvh4

FreeRDP before 3.29.0 Denial of Service via smartcard cache

HIGH 77

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00426 Published 2026-08-01 Fixed in 3.29.0 CWE-476

TI-2026-39874 CVE-2026-55194