Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:62571: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-12.el8_10. Fixed in 2:2.11.7-12.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, including Microsoft Windows machines and VirtualBox. It is widely used for remote access in various environments. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from improper handling of crafted RDP update orders, smartcard cache requests, and heap memory management. Specifically, CVE-2026-55194 allows for arbitrary code execution through a heap-buffer overflow, while CVE-2026-67288 and CVE-2026-67291 can lead to denial of service via crafted requests. Additionally, CVE-2026-67301 poses a risk of memory disclosure, potentially exposing sensitive information.
How To Fix
Minimum fixed version
2:2.11.7-12.el8_10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security updates as soon as they are available.
Conclusion
The recent vulnerabilities in FreeRDP pose significant risks, including potential arbitrary code execution and denial of service. It is imperative to update to the latest patched version to safeguard systems against these threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), enabling users to connect to remote desktops and servers.
The identified vulnerabilities include memory disclosure, denial of service, and arbitrary code execution due to improper handling of RDP requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize the update to mitigate the risks associated with these vulnerabilities.
For detailed information, refer to the CVE pages associated with the vulnerabilities: CVE-2026-55194, CVE-2026-67288, CVE-2026-67291, and CVE-2026-67301.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
