RHSA-2026:94514HighCVSS 8.8

Red Hat Security Advisory: freerdp security, bug fix, and enhancement update

Published
November 3, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (33)

CVE-2026-111880 →CVE-2026-121402 →CVE-2026-121963 →CVE-2026-121964 →CVE-2026-110839 →CVE-2026-121956 →CVE-2026-109242 →CVE-2026-121961 →CVE-2026-121962 →CVE-2026-121388 →CVE-2026-121951 →CVE-2026-121958 →CVE-2026-121959 →CVE-2026-110837 →CVE-2026-111379 →CVE-2026-121394 →CVE-2026-121952 →CVE-2026-109676 →CVE-2026-111382 →CVE-2026-121953 →CVE-2026-121955 →CVE-2026-110830 →CVE-2026-111381 →CVE-2026-114045 →CVE-2026-121404 →CVE-2026-121950 →CVE-2026-110838 →CVE-2026-111378 →CVE-2026-121954 →CVE-2026-121957 →CVE-2026-121960 →CVE-2026-121386 →CVE-2026-110833 →

📋 Description

CVE-2026-109242 — freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109676 — freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect CVE-2026-110830 — freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling CVE-2026-110833 — freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly CVE-2026-110837 — freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding CVE-2026-110838 — freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch CVE-2026-110839 — freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion CVE-2026-111378 — freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser CVE-2026-111379 — freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file CVE-2026-111381 — freerdp: freerdp: Arbitrary code execution via crafted persistent cache file CVE-2026-111382 — freerdp: freerdp: Arbitrary code execution via crafted display frames CVE-2026-111880 — freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication CVE-2026-114045 — freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats CVE-2026-121386 — freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads CVE-2026-121388 — freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels CVE-2026-121394 — freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder CVE-2026-121402 — freerdp: freerdp: Denial of Service via zero-width graphics reset CVE-2026-121404 — freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages CVE-2026-121950 — freerdp: FreeRDP: Heap buffer overflow via integer overflow in surface creation CVE-2026-121951 — freerdp: FreeRDP: Denial of Service via truncated input event CVE-2026-121952 — freerdp: freerdp: Out-of-bounds write in proxy bitmap cache v2 capability handling CVE-2026-121953 — freerdp: freerdp: Use-after-free via rdpgfx dynamic virtual channel close CVE-2026-121954 — freerdp: freerdp: Denial of Service via heap out-of-bounds write in planar codec CVE-2026-121955 — freerdp: freerdp: Denial of Service via use-after-free in smartcard emulation CVE-2026-121956 — freerdp: freerdp: Denial of Service via crafted Kerberos authentication request CVE-2026-121957 — freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding CVE-2026-121958 — freerdp: FreeRDP: Heap-based buffer overflow via surface key truncation in RDPGFX CVE-2026-121959 — freerdp: freerdp: Denial of Service via infinite loop on truncated WebSocket frame CVE-2026-121960 — freerdp: freerdp: Denial of Service via missing negotiation tokens in CredSSP request CVE-2026-121961 — freerdp: FreeRDP: Denial of Service via dynamic channel race condition in proxy CVE-2026-121962 — freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization CVE-2026-121963 — freerdp: freerdp: Denial of Service via dynamic audio channel use-after-free CVE-2026-121964 — freerdp: freerdp: Arbitrary code execution via RD Gateway RPC client heap buffer overflow

🎯 Affected products67

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +37 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers. Workaround: Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers. Workaround: If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers. Workaround: Do not expose freerdp-shadow-cli to untrusted networks. Restrict access with host firewalling and require authentication. Workaround: If clipboard redirection is unused, disable it. Restrict FreeRDP clients to trusted servers. Workaround: Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required. 1. Restrict RDP access to trusted network sources using firewalld: # firewall-cmd --permanent --zone=public --remove-service=rdp # firewall-cmd --permanent --zone=trusted --add-source=<trusted_IP_or_CIDR> # firewall-cmd --reload 2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop): # systemctl --user --now mask gnome-remote-desktop.service Caveats and Warnings: Reloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not expose FreeRDP server or proxy endpoints that use SspiNtlmHashCallback to untrusted networks; restrict access with a host firewall and network segmentation. If the NTLM hash callback is not required, leave it unset so the vulnerable MIC path is not entered. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds validation on Message Integrity Check (MIC) offsets within the authenticate message buffer before writing in ntlm_computeMicValue: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which validate that the MIC offset is within the authenticate message buffer bounds before writing bytes, closing crafted NTLM AUTHENTICATE_MESSAGE with backward session-key offset and out-of-bounds MIC offset. Until patched, this is a concern on FreeRDP server and proxy instances configured with the non-default SspiNtlmHashCallback setting, so leave SspiNtlmHashCallback unset if NTLM hash callbacks are not required, and restrict network access to FreeRDP endpoints from untrusted networks using firewalls and network segmentation. As a compensating measure, configure systemd service restart and watchdog settings to automatically restart FreeRDP upon process crashes and mitigate prolonged denial of service, require pre-authentication through a zero-trust gateway or identity-aware proxy before clients can reach the FreeRDP NTLM authentication handler, and restrict FreeRDP port access with host firewalls using firewalld or nftables to isolate the service from untrusted networks. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds write defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high) Workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required. Workaround: Disable clipboard redirection for RDP connections. When launching sessions with the xfreerdp command-line utility, explicitly disable the clipboard channel: ``` xfreerdp -clipboard /v:<server_address> ``` When connecting via graphical clients, disable clipboard synchronization within the respective connection profile preferences. Caveats: Disabling clipboard redirection prevents transferring text, images, or files between the local system and the remote session. Warning: Changes apply to new connections; any active RDP sessions must be disconnected and restarted for the setting to take effect. --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to disable clipboard redirection in FreeRDP client connections to prevent processing untrusted image buffers through WinPR: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which install setjmp error handlers for libpng and libjpeg in winpr_read_png_from_buffer, winpr_convert_from_jpeg, and winpr_convert_to_jpeg, closing all 2 injection vectors (malformed PNG clipboard payload, truncated JPEG clipboard payload). Until patched, this is a concern on FreeRDP client sessions with clipboard redirection enabled connecting across untrusted networks or to untrusted RDP servers, so Disable clipboard redirection by using the -clipboard flag in xfreerdp or disabling clipboard synchronization in graphical connection profiles, then disconnect and restart active sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing image library error-handling defect — apply the upstream patch to fully remediate. Workaround: To mitigate this restrict outbound client connections strictly to trusted RDP servers and enforce memory limits via OS process resource limits or cgroups v2 to prevent multi-gigabyte memory exhaustion on 64-bit hosts. On 32-bit or sensitive environments, ensure ASLR and glibc heap allocator hardening are active to mitigate heap corruption risks. Workaround: Restrict exposure by limiting RDP network traffic to trusted hosts or subnets using firewalld: 1. Add the trusted administrative subnet to the trusted zone: firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet> 2. Remove general access to the RDP port (default 3389/tcp) from public zones: firewall-cmd --permanent --zone=public --remove-port=3389/tcp 3. Apply the firewall configuration: firewall-cmd --reload Warning: Reloading firewall rules may briefly interrupt active network sessions. Additionally, stop any running `freerdp-shadow-cli` or custom FreeRDP server processes if remote session sharing is not actively required. Caveat: Network access controls mitigate untrusted exposure but do not defend against malicious input sent by authorized clients within the permitted network. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate remaining stream length before advancing stream pointers in FreeRDP server-side slow-path input parsing: upg…

🔗 References (16)