Moderate Vulnerability in FreeRDP: Denial of Service and Information Disclosure Risks
Summary
ALSA-2026:16482: Moderate: freerdp security update. Affects freerdp versions < 2:2.11.7-1.el9_7.7. Fixed in 2:2.11.7-1.el9_7.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), allowing users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. It is released under the Apache license and is widely used for remote desktop access. The package includes various components such as the xfreerdp client and libraries that facilitate RDP connections. However, recent security updates have revealed multiple vulnerabilities that could lead to denial of service and information disclosure, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in FreeRDP stem from various coding issues, including use-after-free errors, double free vulnerabilities, and heap buffer overflows. These flaws can lead to denial of service attacks, where the application becomes unresponsive, and in some cases, they can allow attackers to read sensitive information from memory. Specific vulnerabilities include CVE-2026-25952, CVE-2026-26986, and CVE-2026-33985, among others. The potential ramifications include service interruptions and unauthorized access to sensitive data, making it crucial for users to address these vulnerabilities promptly.
How To Fix
Minimum fixed version
2:2.11.7-1.el9_7.7
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the FreeRDP service or disable certain features that may trigger the vulnerabilities until the update is applied. Additionally, monitoring logs for unusual activity can help identify potential exploitation attempts.
Conclusion
The recent vulnerabilities in FreeRDP pose significant risks, including denial of service and potential information disclosure. Users are strongly advised to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) that allows users to connect to remote servers and desktops.
The vulnerabilities include denial of service attacks, heap buffer overflows, and information disclosure risks due to coding errors.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
As a workaround, you can limit access to the FreeRDP service and monitor logs for any unusual activity until you can apply the update.
Detailed information about the vulnerabilities can be found on the respective CVE pages linked in the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
