Red Hat Security AdvisoryRHSA-2026:68706
freerdp security update
Released 2026-09-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) freerdp-2:3.10.3-3.el10_0.16, freerdp-libs-2:3.10.3-3.el10_0.16, libwinpr-2:3.10.3-3.el10_0.16
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) freerdp-devel-2:3.10.3-3.el10_0.16, freerdp-server-2:3.10.3-3.el10_0.16, libwinpr-devel-2:3.10.3-3.el10_0.16
Fixes 13 records
Priority HIGH 77
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00651 · Published 2026-08-01 · Fixed in 3.29.0 CWE-476
Priority HIGH 77
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00651 · Published 2026-08-01 · Fixed in 3.29.0 CWE-125
Priority HIGH 77
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c).
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00718 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-191
Priority HIGH 77
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body().
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00521 · Published 2026-08-01 · Fixed in 3.29.0 CWE-770
Priority HIGH 77
FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00521 · Published 2026-08-01 · Fixed in 3.29.0 CWE-20
Priority HIGH 77
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0041 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-125
Priority HIGH 77
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00426 · Published 2026-08-01 · Fixed in 3.29.0 CWE-476
Priority HIGH 73
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00619 · Published 2026-08-19 · Fixed in 3.27.0 CWE-122
Priority HIGH 71
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00468 · Published 2026-08-11 · Fixed in 3.30.0 CWE-287
Priority HIGH 69
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00399 · Published 2026-08-11 · Fixed in 3.30.0 CWE-122
Priority HIGH 69
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00619 · Published 2026-08-19 · Fixed in 3.28.0 CWE-122
Priority MEDIUM 64
FreeRDP is a free implementation of the Remote Desktop Protocol.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00583 · Published 2026-08-19 · Fixed in 3.28.0 CWE-415
Priority MEDIUM 45
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00616 · Published 2026-08-01 · Partial fix · 3.29.0 CWE-125
THREATIST.IORead the docs