Critical Security Flaw in FreeRDP: Remote Code Execution and Denial of Service Vulnerabilities
Summary
RLSA-2026:76755: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.8. Fixed in 2:2.11.7-7.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote servers and desktops, including Microsoft Windows machines and VirtualBox. It is widely used for remote access and management due to its flexibility and compatibility with various systems. However, recent vulnerabilities have been identified that could severely impact its security and functionality.
Vulnerability Detail
The vulnerabilities in FreeRDP include a denial of service via crafted Surface Bits command, remote code execution due to a heap buffer overflow in the Server Redirection PDU, and other critical issues such as out-of-bounds reads and uninitialized heap memory disclosures. These vulnerabilities can lead to unauthorized access, system crashes, and potential exploitation by malicious actors, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.8
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the FreeRDP client and avoid connecting to untrusted RDP servers until the update is applied. Additionally, monitoring network traffic for unusual activity may help mitigate risks.
Conclusion
The vulnerabilities in FreeRDP pose significant risks, including remote code execution and denial of service. It is crucial for users to update to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops and servers.
The main vulnerabilities include remote code execution, denial of service, and heap buffer overflows, which can lead to unauthorized access and system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of the vulnerability is 8.8, indicating a high level of severity.
You can update FreeRDP by running the command 'sudo dnf update freerdp' in your terminal to ensure you have the latest security fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
