Critical Remote Code Execution Vulnerability in FreeRDP
Summary
RLSA-2026:66349: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.11. Fixed in 2:3.10.3-12.el10_2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines, xrdp, and VirtualBox. It is widely used for remote access and management of systems. The package is released under the Apache license and is known for its flexibility and compatibility with various RDP servers. However, it has recently been identified as vulnerable to a critical security issue that could allow remote code execution or client crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2026-55193, arises from a flaw in the handling of connections to malicious TS Gateways. An attacker could exploit this vulnerability to execute arbitrary code on the client machine or cause the client to crash, leading to potential data loss or unauthorized access. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high risk to users who have not updated their FreeRDP installations.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.11
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid connecting to untrusted TS Gateways until the package is updated. Additionally, users should ensure that their firewall settings are configured to limit access to trusted networks only.
Conclusion
The FreeRDP package has a critical vulnerability (CVE-2026-55193) that could lead to remote code execution or client crashes. Users are strongly advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
CVE-2026-55193 refers to a critical vulnerability in FreeRDP that allows for remote code execution or client crashes via malicious TS Gateways.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can update FreeRDP by running the command 'sudo dnf update freerdp' in your terminal to install the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
