Critical Remote Code Execution Vulnerability in FreeRDP Packages
Summary
ALSA-2026:66349: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.11. Fixed in 2:3.10.3-12.el10_2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote desktops and servers. It is widely used for accessing Windows machines, xrdp, and VirtualBox environments. The affected packages include freerdp, freerdp-devel, freerdp-libs, freerdp-server, libwinpr, and libwinpr-devel, all of which are integral to the functionality of FreeRDP. The vulnerability in question poses a significant risk, as it can lead to remote code execution or client crashes when exploited through a malicious TS Gateway.
Vulnerability Detail
The vulnerability, identified as CVE-2026-55193, allows an attacker to execute arbitrary code on the client machine or cause it to crash by sending specially crafted requests to the FreeRDP client. This issue arises from improper handling of responses from a TS Gateway, which can be exploited by malicious actors to gain unauthorized access or disrupt services. The severity of this vulnerability necessitates immediate attention and remediation.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.11
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the TS Gateway or disable it until the update is applied. Additionally, monitoring network traffic for suspicious activity can help mitigate potential exploitation.
Conclusion
The vulnerability in FreeRDP, identified as CVE-2026-55193, poses a serious risk of remote code execution or client crashes. It is imperative to update the affected packages to the patched version to safeguard against exploitation. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
CVE-2026-55193 refers to a critical vulnerability in FreeRDP that can lead to remote code execution or client crashes via malicious TS Gateway requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider restricting access to the TS Gateway and monitoring for any suspicious activity as a temporary workaround.
Addressing this vulnerability is crucial to prevent potential unauthorized access and ensure the security and stability of your systems.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
