Critical Security Update for FreeRDP: Heap Buffer Overflow and DoS Vulnerabilities
Summary
ALSA-2026:8457: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-1.el9_7.6. Fixed in 2:2.11.7-1.el9_7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote desktops and servers. It is widely used for accessing Windows machines and other RDP-compatible servers. The package includes various components such as xfreerdp, which serves as the client interface. Due to its extensive use in remote access scenarios, any vulnerabilities in FreeRDP can have significant implications for security and system integrity.
Vulnerability Detail
The vulnerabilities identified in FreeRDP include a heap buffer overflow and a denial of service (DoS) issue. The heap buffer overflow (CVE-2026-33984) allows attackers to execute arbitrary code by sending crafted pixel data to the client. This can lead to unauthorized access and control over the affected system. The DoS vulnerability (CVE-2026-33983) allows attackers to crash the client by sending specially crafted RDP messages, disrupting service availability. Both vulnerabilities stem from improper handling of input data, highlighting the need for robust input validation.
How To Fix
Minimum fixed version
2:2.11.7-1.el9_7.6
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the FreeRDP client or disable remote desktop connections until the update is applied. Additionally, monitoring network traffic for unusual RDP messages may help mitigate the risk of exploitation.
Conclusion
The vulnerabilities in FreeRDP pose significant risks, including arbitrary code execution and denial of service. It is crucial for users to update to the latest patched version to safeguard their systems. By following the recommended steps and utilizing available tools like Vulert, users can effectively manage and mitigate these risks.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol, enabling users to connect to remote desktops and servers.
The update addresses a heap buffer overflow that allows arbitrary code execution and a denial of service vulnerability that can crash the client.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider limiting access to the FreeRDP client and monitoring for unusual activity.
More details can be found on the CVE pages for CVE-2026-33983 and CVE-2026-33984, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
