Critical Security Flaw in FreeRDP: Resource Exhaustion and Denial of Service Vulnerabilities
Summary
RLSA-2026:61378: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.10. Fixed in 2:3.10.3-12.el10_2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops. It is widely used for accessing Windows machines, xrdp, and VirtualBox environments. The software is released under the Apache license and is known for its flexibility and compatibility with various RDP servers. However, recent vulnerabilities have been identified that could lead to severe security risks, including resource exhaustion and denial of service.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from improper handling of RDP messages and requests, leading to various issues such as resource exhaustion from oversized HTTP responses, memory disclosure, and denial of service through crafted requests. Specific vulnerabilities include heap buffer overflows, integer underflows, and authentication bypasses, which could allow attackers to execute arbitrary code or crash the application. The CVSS score for these vulnerabilities is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to FreeRDP services or implement network-level protections to mitigate the risk of exploitation until the package is updated.
Conclusion
The identified vulnerabilities in FreeRDP pose serious security threats, including denial of service and potential arbitrary code execution. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The vulnerabilities can lead to resource exhaustion, denial of service, memory disclosure, and even arbitrary code execution, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing network-level protections or limiting access to FreeRDP services as a temporary workaround.
For detailed information, refer to the CVE pages associated with the vulnerabilities listed in the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
