Critical Security Flaw in FreeRDP: Out-of-Bounds Write Vulnerability
Summary
RLSA-2026:37207: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.4. Fixed in 2:2.11.7-7.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines, xrdp, and VirtualBox. It is widely used for remote access and management of systems. The package is released under the Apache license and is integral for users who require remote desktop capabilities. However, a recent vulnerability has been identified that poses significant security risks to users of FreeRDP.
Vulnerability Detail
The vulnerability, identified as CVE-2026-45700, is an out-of-bounds write issue in the planar bitmap decoder of FreeRDP. This flaw allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or complete system compromise. The vulnerability arises from improper handling of memory, which can be exploited by sending specially crafted RDP packets to the FreeRDP client. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.4
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the FreeRDP client by restricting access to trusted networks and disabling remote desktop connections until the package is updated. Additionally, users should avoid connecting to untrusted RDP servers.
Conclusion
The FreeRDP package has a critical vulnerability that can lead to arbitrary code execution. Users are strongly advised to update to the latest patched version to protect their systems. Implementing workarounds and monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
CVE-2026-45700 is an out-of-bounds write vulnerability in FreeRDP that can lead to arbitrary code execution on affected systems.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
If an immediate update is not possible, consider restricting access to the FreeRDP client and avoid connecting to untrusted RDP servers as a temporary measure.
The CVSS score for CVE-2026-45700 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
