Critical Security Update for FreeRDP: Remote Code Execution and Denial of Service Vulnerabilities
Summary
ALSA-2026:76755: Important: freerdp security update. Affects freerdp versions < 2:2.11.7-7.el9_8.8. Fixed in 2:2.11.7-7.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), allowing users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include a denial of service via crafted Surface Bits command (CVE-2026-91954), remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964), denial of service due to out-of-bounds read in URBDRC channel (CVE-2026-91956), remote code execution via uninitialized heap memory disclosure (CVE-2026-91963), denial of service due to buffer over-read in RPC gateway (CVE-2026-91959), and heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token leading to heap corruption (CVE-2026-91953). These vulnerabilities can lead to severe security risks, including unauthorized access and system crashes.
How To Fix
Minimum fixed version
2:2.11.7-7.el9_8.8
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the FreeRDP service or using alternative remote desktop solutions until the vulnerabilities are patched.
Conclusion
The vulnerabilities in FreeRDP pose significant security risks, including potential remote code execution and denial of service. It is crucial for users to update to the latest patched versions of the affected packages to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops.
The vulnerabilities include remote code execution and denial of service attacks due to various flaws in the FreeRDP implementation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Consider implementing access restrictions to the FreeRDP service or switching to alternative remote desktop solutions until you can apply the updates.
More details can be found on the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
