Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:6799: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-5.el10_1.5. Fixed in 2:3.10.3-5.el10_1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, including Microsoft Windows machines and VirtualBox. It is released under the Apache license and is widely used for remote access solutions. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing FreeRDP, necessitating immediate attention and updates.
Vulnerability Detail
The vulnerabilities in FreeRDP include several critical issues such as heap-use-after-free and heap-buffer-overflow, which can lead to denial of service or arbitrary code execution. These vulnerabilities arise from improper memory management and can be exploited by attackers through crafted RDP server messages, potentially allowing them to execute malicious code or crash the application. The identified CVEs include CVE-2026-22852, CVE-2026-22854, CVE-2026-22856, and others, each posing significant risks to users and systems relying on FreeRDP.
How To Fix
Minimum fixed version
2:3.10.3-5.el10_1.5
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling remote desktop access until the update is applied. However, this is not a long-term solution and should only be used to mitigate immediate risks.
Conclusion
The vulnerabilities identified in FreeRDP pose significant risks to users and systems utilizing this software for remote access. It is crucial to update to the patched version to safeguard against potential exploits. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert and to implement temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The vulnerabilities can lead to denial of service, arbitrary code execution, and potential unauthorized access to sensitive data.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider disabling remote desktop access as a temporary measure to mitigate risks.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the advisory, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
