Critical Security Update for FreeRDP: Heap Buffer Overflow and Denial of Service Vulnerabilities
Summary
ALSA-2026:8458: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-5.el10_1.6. Fixed in 2:3.10.3-5.el10_1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops. It is widely used for accessing Windows machines, xrdp, and VirtualBox environments. The package includes various components such as the xfreerdp client, freerdp-server, and libraries for development. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include a heap buffer overflow that allows for arbitrary code execution through crafted pixel data (CVE-2026-33984) and a denial of service caused by specially crafted Remote Desktop Protocol messages (CVE-2026-33983). These vulnerabilities can lead to unauthorized access and system crashes, posing significant risks to users and organizations relying on FreeRDP for remote connections.
How To Fix
Minimum fixed version
2:3.10.3-5.el10_1.6
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the FreeRDP service or disable it until the update is applied. Additionally, monitoring network traffic for unusual patterns may help mitigate the risk of exploitation until the patch is installed.
Conclusion
The identified vulnerabilities in FreeRDP pose significant risks, including potential arbitrary code execution and denial of service. It is crucial for users and organizations to update to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The main vulnerabilities include a heap buffer overflow allowing arbitrary code execution and a denial of service via specially crafted RDP messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
If an immediate update is not possible, consider limiting access to the FreeRDP service and monitoring network traffic for suspicious activity.
More information can be found on the CVE pages for CVE-2026-33983 and CVE-2026-33984, which provide detailed insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
