Red Hat Security AdvisoryRHSA-2026:65855
freerdp security update
Released 2026-09-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) freerdp-2:2.2.0-14.el8_4.3, freerdp-libs-2:2.2.0-14.el8_4.3, libwinpr-2:2.2.0-14.el8_4.3 +1
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) freerdp-2:2.2.0-14.el8_4.3, freerdp-libs-2:2.2.0-14.el8_4.3, libwinpr-2:2.2.0-14.el8_4.3 +1
Fixes 4 records
Priority HIGH 77
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00651 · Published 2026-08-01 · Fixed in 3.29.0 CWE-125
Priority HIGH 77
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0041 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-125
Priority HIGH 77
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00426 · Published 2026-08-01 · Fixed in 3.29.0 CWE-476
Priority HIGH 73
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00619 · Published 2026-08-19 · Fixed in 3.27.0 CWE-122
THREATIST.IORead the docs