Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:61379: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.6. Fixed in 2:2.11.7-7.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers, including Microsoft Windows machines and VirtualBox. It is widely used for remote desktop access due to its flexibility and compatibility with various platforms. However, recent vulnerabilities have been identified that could potentially compromise the security of systems using FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from improper handling of crafted RDP update orders, smartcard cache requests, and heap memory management. Specifically, CVE-2026-55194 allows for arbitrary code execution via a heap-buffer overflow, while CVE-2026-67288 and CVE-2026-67291 can lead to denial of service through crafted requests. CVE-2026-67301 poses a risk of memory disclosure, which could expose sensitive information. These vulnerabilities can have severe ramifications, including unauthorized access to systems and disruption of services.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.6
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to FreeRDP services or disable features that utilize smartcard authentication until the update is applied. Additionally, monitoring network traffic for unusual patterns may help mitigate potential exploitation.
Conclusion
In summary, the recent vulnerabilities in FreeRDP pose significant security risks that can lead to unauthorized access and service disruption. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote desktops and servers.
The main vulnerabilities include memory disclosure, denial of service, and arbitrary code execution due to improper handling of RDP requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as limiting access to FreeRDP services and monitoring network traffic.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
