Critical Security Flaw in FreeRDP: Heap Buffer Overflow and Denial of Service Vulnerabilities
Summary
RLSA-2026:8458: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-5.el10_1.6. Fixed in 2:3.10.3-5.el10_1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines and VirtualBox. It is widely used for remote access and management due to its flexibility and compatibility with various systems. However, recent vulnerabilities have been identified that could compromise the security of systems using FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include a heap buffer overflow that allows for arbitrary code execution via crafted pixel data (CVE-2026-33984) and a denial of service (DoS) vulnerability that can be triggered by specially crafted RDP messages (CVE-2026-33983). These vulnerabilities can lead to unauthorized access and system crashes, posing significant risks to users and organizations relying on FreeRDP for remote connections.
How To Fix
Minimum fixed version
2:3.10.3-5.el10_1.6
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to FreeRDP services or implement network-level protections to filter out malicious RDP messages until the update is applied.
Conclusion
The vulnerabilities in FreeRDP pose significant risks to users, allowing for potential arbitrary code execution and denial of service. It is crucial for users to update to the latest patched version to mitigate these risks and ensure the security of their systems.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The main vulnerabilities include a heap buffer overflow allowing arbitrary code execution and a denial of service vulnerability via crafted RDP messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of the vulnerability is 7.5, indicating a high level of severity.
You can update FreeRDP by running the command 'sudo yum update freerdp' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
