Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:54485: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-11.el8_10. Fixed in 2:2.11.7-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), allowing users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. However, recent vulnerabilities have been identified that could compromise the security of systems using FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include arbitrary code execution via malicious RDP files, denial of service via crafted WindowIcon async messages, HTTP Proxy Request Injection via redirection, and remote code execution or denial of service via audio input integer overflow. These vulnerabilities can lead to severe consequences, including unauthorized access to sensitive data and disruption of service.
How To Fix
Minimum fixed version
2:2.11.7-11.el8_10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the FreeRDP service or disable certain features until the update is applied. However, the most effective solution is to apply the patch as soon as possible.
Conclusion
The recent vulnerabilities identified in FreeRDP pose significant risks to users and systems relying on this software for remote desktop access. It is crucial to apply the necessary updates to mitigate these risks and ensure the security of your systems.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote servers.
The vulnerabilities include arbitrary code execution, denial of service, HTTP Proxy Request Injection, and remote code execution via audio input overflow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
If an immediate update is not possible, consider limiting access to the FreeRDP service or disabling certain features as a temporary workaround.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
