Critical Security Flaw in FreeRDP: Out-of-Bounds Write Vulnerability
Summary
ALSA-2026:37207: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.4. Fixed in 2:2.11.7-7.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops. It is widely used for accessing Windows machines and other RDP-compatible servers. The package includes various components such as xfreerdp, freerdp-devel, and libraries like libwinpr, which are essential for RDP functionalities. However, a significant security vulnerability has been identified that could allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2026-45700, is an out-of-bounds write issue in the planar bitmap decoder of FreeRDP. This flaw can be exploited by attackers to execute arbitrary code on the affected systems, potentially leading to unauthorized access and control over the system. The vulnerability arises from improper handling of memory, which allows data to be written outside the allocated buffer, creating a pathway for malicious code execution.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.4
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The FreeRDP vulnerability CVE-2026-45700 poses a significant risk due to its potential for arbitrary code execution. Users are strongly advised to update their installations to the patched version to safeguard against possible attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security.
See every vulnerability recorded for freerdp →
FAQ
CVE-2026-45700 is a security vulnerability in FreeRDP that allows for arbitrary code execution due to an out-of-bounds write in the planar bitmap decoder.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access, data breaches, and complete control over the affected systems by attackers.
Yes, a patch is available in version 2:2.11.7-7.el9_8.4 for the affected FreeRDP packages.
While there are no specific workarounds, it is recommended to prioritize updating your packages to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
