Moderate Vulnerability in FreeRDP: Denial of Service and Information Disclosure Risks
Summary
ALSA-2026:16019: Moderate: freerdp security update. Affects freerdp versions < 2:2.11.7-9.el8_10. Fixed in 2:2.11.7-9.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), enabling users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. However, recent vulnerabilities have been identified that could compromise the security and stability of applications relying on FreeRDP.
Vulnerability Detail
The vulnerabilities in FreeRDP include a denial of service due to a use-after-free vulnerability (CVE-2026-25952), a double free vulnerability during disconnect (CVE-2026-26986), and an endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951). Additionally, there are heap-buffer-overflow issues (CVE-2026-29775), out-of-bounds reads in ADPCM decoders (CVE-2026-31885), and a division-by-zero error (CVE-2026-31884). These vulnerabilities can lead to service interruptions, information disclosure, and potential exploitation by attackers.
How To Fix
Minimum fixed version
2:2.11.7-9.el8_10
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may limit access to the FreeRDP service or implement network-level security controls to mitigate potential exploitation until the patch is applied.
Conclusion
The vulnerabilities in FreeRDP pose significant risks, including denial of service and potential information disclosure. It is crucial for users and administrators to update their installations to the latest patched versions to mitigate these risks effectively.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops.
The identified vulnerabilities include denial of service, heap-buffer-overflow, out-of-bounds reads, and division-by-zero errors.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without requiring signup.
If immediate updates are not possible, consider implementing network security measures to restrict access to the FreeRDP service.
For detailed information about the vulnerabilities, refer to the CVE pages listed in the advisory or the official FreeRDP documentation.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
