Critical Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:76747: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-14.el8_10. Fixed in 2:2.11.7-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, such as Microsoft Windows machines, xrdp, and VirtualBox. It is widely used for remote access due to its flexibility and compatibility with various systems. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing FreeRDP, necessitating immediate attention and updates.
Vulnerability Detail
The vulnerabilities in FreeRDP include a denial of service via crafted Surface Bits command, remote code execution due to a heap buffer overflow in Server Redirection PDU, denial of service from an out-of-bounds read in the URBDRC channel, remote code execution from uninitialized heap memory disclosure, and denial of service due to buffer over-read in the RPC gateway. These vulnerabilities can lead to severe consequences, including unauthorized access to sensitive data and system crashes.
How To Fix
Minimum fixed version
2:2.11.7-14.el8_10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the FreeRDP service or disable features that are known to be vulnerable until the update is applied. However, this is not a permanent solution and should only be used until the patch is installed.
Conclusion
The vulnerabilities identified in FreeRDP pose significant risks to users and systems relying on this software for remote access. It is crucial to apply the recommended updates promptly to mitigate these risks and ensure the security of your systems.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The vulnerabilities include denial of service attacks and remote code execution risks due to buffer overflows and memory disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
As a temporary measure, limit access to the FreeRDP service or disable vulnerable features until the update can be applied.
For detailed information, refer to the CVE pages associated with the vulnerabilities listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
