Moderate Security Update for FreeRDP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:16014: Moderate: freerdp security update. Affects freerdp versions < 2:3.10.3-5.el10_1.8. Fixed in 2:3.10.3-5.el10_1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), allowing users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. However, recent vulnerabilities have been identified that could compromise the security and stability of the application.
Vulnerability Detail
The vulnerabilities in FreeRDP include several denial of service (DoS) issues due to use-after-free and double-free vulnerabilities, as well as heap-buffer-overflows and out-of-bounds reads. These vulnerabilities can lead to application crashes, information disclosure, and even arbitrary code execution, posing significant risks to users and systems relying on FreeRDP for remote access.
How To Fix
Minimum fixed version
2:3.10.3-5.el10_1.8
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling certain features of FreeRDP that are known to trigger the vulnerabilities, such as auto-reconnect and specific audio data handling. However, this is not a permanent solution and updating the software is strongly recommended.
Conclusion
The identified vulnerabilities in FreeRDP pose significant risks to users, including potential denial of service and information disclosure. It is crucial to update to the latest patched version to mitigate these risks and ensure secure remote desktop access.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote desktops.
The vulnerabilities include denial of service issues, heap-buffer-overflows, and out-of-bounds reads, which can lead to crashes and information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider disabling features that may trigger the vulnerabilities as a temporary workaround.
For detailed information, refer to the CVE pages linked in the vulnerability report or the official FreeRDP documentation.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
