Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:75570: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-12.el10_2.14. Fixed in 2:3.10.3-12.el10_2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, including Microsoft Windows machines and various virtualization platforms. It is widely used for remote access in various environments. The recent vulnerabilities identified in FreeRDP can lead to severe security risks, including information disclosure, denial of service, and remote code execution, making it crucial for users to address these issues promptly.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from multiple coding flaws, including uninitialized heap memory access, buffer overflows, and improper handling of commands. These vulnerabilities can lead to information disclosure, denial of service, and remote code execution, potentially allowing attackers to gain unauthorized access to sensitive data or disrupt services. Specific issues include an information disclosure via uninitialized heap memory in Save Session Info PDU, denial of service via crafted Surface Bits command, and remote code execution via heap buffer overflow in Server Redirection PDU.
How To Fix
Minimum fixed version
2:3.10.3-12.el10_2.14
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to FreeRDP services or disable features that are known to be vulnerable until the update can be applied. Additionally, monitoring network traffic for unusual activity may help mitigate potential exploitation.
Conclusion
The recent vulnerabilities in FreeRDP pose significant security risks that can lead to unauthorized access and service disruptions. It is imperative for users to update their installations to the latest patched version to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The update addresses vulnerabilities including information disclosure, denial of service, and remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
If you cannot update immediately, consider limiting access to FreeRDP services and monitoring for unusual activity as a temporary workaround.
More details about the vulnerabilities can be found on the CVE pages listed in the advisory, which provide insights into the impact and technical specifics.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
