Red Hat Security Advisory

RHSA-2026:68707

freerdp security update

Released 2026-09-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7 ELS) freerdp-2.1.1-5.el7_9.12, freerdp-libs-2.1.1-5.el7_9.12, freerdp-libs-2.1.1-5.el7_9.12.ppc +2
Red Hat Enterprise Linux Server Optional (v. 7 ELS) freerdp-devel-2.1.1-5.el7_9.12, freerdp-devel-2.1.1-5.el7_9.12.ppc, libwinpr-devel-2.1.1-5.el7_9.12 +1

Fixes 7 records

TI-2026-47597 CVE-2026-67301 · GHSA-vpv4-cm44-pgmc

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

HIGH 77

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00651 Published 2026-08-01 Fixed in 3.29.0 CWE-125

TI-2026-47594 CVE-2026-67298 · GHSA-wrfm-6x9r-42cr

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

HIGH 77

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c).

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00718 Published 2026-08-01 Partial fix · 3.29.0 CWE-191

TI-2026-47587 CVE-2026-67291 · GHSA-qx25-fqx8-cgm7

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

HIGH 77

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0041 Published 2026-08-01 Partial fix · 3.29.0 CWE-125

TI-2026-47584 CVE-2026-67288 · GHSA-hq8h-rvcv-jvh4

FreeRDP before 3.29.0 Denial of Service via smartcard cache

HIGH 77

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00426 Published 2026-08-01 Fixed in 3.29.0 CWE-476

TI-2026-39874 CVE-2026-55194

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

HIGH 73

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00619 Published 2026-08-19 Fixed in 3.27.0 CWE-122

TI-2026-39872 CVE-2026-55192

FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

HIGH 73

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.0045 Published 2026-08-19 Partial fix · 3.27.0 CWE-125

TI-2026-47586 CVE-2026-67290 · GHSA-v8g5-qxq2-3959

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

MEDIUM 45

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00616 Published 2026-08-01 Partial fix · 3.29.0 CWE-125