Critical Security Flaw in FreeRDP: Remote Code Execution and Denial of Service Vulnerabilities
Summary
RLSA-2026:76747: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-14.el8_10. Fixed in 2:2.11.7-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines and VirtualBox. It is widely used for remote access and management of systems. The package is released under the Apache license, making it accessible for modification and distribution. However, recent vulnerabilities have been identified that could severely compromise the security of systems utilizing FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include multiple critical issues such as remote code execution and denial of service. Specifically, a crafted Surface Bits command can lead to a denial of service (CVE-2026-91954), while a heap buffer overflow in the Server Redirection PDU can allow remote code execution (CVE-2026-91964). Other vulnerabilities include out-of-bounds reads, uninitialized heap memory disclosures, and buffer over-reads, which can lead to further exploitation and system instability. The CVSS score for these vulnerabilities is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:2.11.7-14.el8_10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling remote desktop access temporarily or restricting access to trusted IP addresses until the vulnerabilities can be addressed. Additionally, monitor your systems for any unusual activity that may indicate exploitation attempts.
Conclusion
The vulnerabilities identified in FreeRDP pose significant risks, including remote code execution and denial of service. It is crucial for users and administrators to update their FreeRDP installations to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote desktops and servers.
The main vulnerabilities include remote code execution, denial of service, and various buffer overflow issues that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update immediately, consider disabling remote desktop access or restricting access to trusted IP addresses as a temporary measure.
The CVSS score for the vulnerabilities in FreeRDP is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
