Critical Security Flaw in FreeRDP: Multiple Vulnerabilities Leading to Remote Code Execution and Denial of Service
Summary
RLSA-2026:75570: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.14. Fixed in 2:3.10.3-12.el10_2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), allowing users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. The recent vulnerabilities discovered in FreeRDP expose users to significant security risks, including remote code execution and denial of service, making it crucial for users to address these issues promptly.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from various flaws, including uninitialized heap memory, buffer overflows, and use-after-free conditions. These vulnerabilities can lead to information disclosure, denial of service, and even remote code execution. Specifically, issues such as the heap buffer overflow in the Server Redirection PDU and the information disclosure via uninitialized heap memory can allow attackers to exploit the system, potentially leading to unauthorized access and control over the affected systems.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.14
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the FreeRDP service or disable features that are known to be vulnerable until the package can be updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The vulnerabilities in FreeRDP pose significant risks, including remote code execution and denial of service. It is essential for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote servers and desktops.
The vulnerabilities include information disclosure, denial of service, and remote code execution, primarily due to memory management issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score of the vulnerabilities is 8.8, indicating a high level of severity.
If you cannot update immediately, consider limiting access to the FreeRDP service or disabling vulnerable features as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
