Critical Remote Code Execution Vulnerability in FreeRDP Package
Summary
RLSA-2026:66347: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.7. Fixed in 2:2.11.7-7.el9_8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines, xrdp, and VirtualBox. It is widely used for remote access and management of systems. The package is released under the Apache license and is integral for users needing remote desktop capabilities. However, it has been identified to have a significant security vulnerability that could lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2026-55193, allows for remote code execution or client crashes when the xfreerdp client connects to a malicious TS Gateway. This could enable attackers to execute arbitrary code on the client machine or disrupt the service, leading to potential data breaches or loss of service. The vulnerability arises from improper handling of responses from the TS Gateway, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.7
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid connecting to untrusted TS Gateways until the package is updated. This reduces the risk of exploitation while waiting for the patch to be applied.
Conclusion
The FreeRDP package has a critical vulnerability (CVE-2026-55193) that can lead to remote code execution or client crashes. Users are strongly advised to update to the patched version to secure their systems. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
CVE-2026-55193 is a vulnerability in FreeRDP that allows for remote code execution or client crashes when connecting to a malicious TS Gateway.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If you cannot update the package immediately, avoid connecting to untrusted TS Gateways to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
