Critical Security Update for FreeRDP: Addressing Multiple Buffer Overflows
Summary
ALSA-2026:3068: Important: freerdp security update. Affects freerdp versions < 2:3.10.3-5.el10_1.2. Fixed in 2:3.10.3-5.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to remote desktops and servers, including Microsoft Windows machines and VirtualBox. It is widely used for remote access and management of systems. The recent vulnerabilities identified in FreeRDP expose users to potential security risks, including unauthorized access and denial of service.
Vulnerability Detail
The vulnerabilities in FreeRDP include multiple heap-buffer-overflows and a global-buffer-overflow that can lead to memory corruption, allowing attackers to execute arbitrary code or crash the application. Specifically, CVE-2026-22853 and CVE-2026-22855 detail heap-buffer-overflows, while CVE-2026-22858 describes a global-buffer-overflow. Additionally, CVE-2026-24678 highlights a use-after-free vulnerability in the ecam_channel_write function, which can be exploited to cause a denial of service.
How To Fix
Minimum fixed version
2:3.10.3-5.el10_1.2
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of FreeRDP until the update is applied. Avoid connecting to untrusted RDP servers and consider using alternative remote access solutions until the vulnerabilities are addressed.
Conclusion
The identified vulnerabilities in FreeRDP pose significant security risks that can lead to unauthorized access and denial of service. It is crucial for users to update their installations to the patched version to mitigate these risks effectively.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), enabling remote desktop connections to various operating systems.
The vulnerabilities can lead to memory corruption, allowing attackers to execute arbitrary code or crash the application, potentially compromising system security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, limit the use of FreeRDP and avoid connecting to untrusted RDP servers as a temporary measure.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
