Critical Security Update for FreeRDP: Remote Code Execution and Denial of Service Vulnerabilities
Summary
ALSA-2026:54486: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.8. Fixed in 2:3.10.3-12.el10_2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines, xrdp, and VirtualBox. It is widely used for remote access and management of systems. However, recent vulnerabilities have been identified that could allow attackers to exploit the software, leading to severe security risks.
Vulnerability Detail
The vulnerabilities in FreeRDP include a heap-based buffer overflow (CVE-2026-64620) that can lead to remote code execution or denial of service. Additionally, a double-free vulnerability (CVE-2026-64621) can be triggered by a crafted .rdp file, potentially allowing remote code execution. Other issues include arbitrary code execution via malicious RDP files (CVE-2026-64624), denial of service through crafted WindowIcon async messages (CVE-2026-67299), HTTP Proxy Request Injection (CVE-2026-67289), and an audio input integer overflow (CVE-2026-68580) that can also lead to remote code execution or denial of service.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.8
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of FreeRDP or avoid opening untrusted .rdp files until the update is applied. Additionally, disabling certain features such as audio input may mitigate some risks until a full update can be performed.
Conclusion
The vulnerabilities in FreeRDP present significant security risks that could lead to remote code execution and denial of service. It is crucial for users to update to the latest patched version to mitigate these risks. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The vulnerabilities include remote code execution, denial of service, and issues related to crafted .rdp files and audio input.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, avoid using untrusted .rdp files and consider disabling features like audio input to reduce risk.
Detailed information can be found on the CVE pages listed in the advisory, which provide insights into the impact and technical details of each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
