RHSA-2026:98598CriticalCVSS 9.3

Red Hat Security Advisory: freerdp security, bug fix, and enhancement update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (48)

CVE-2026-121953 →CVE-2026-85089 →CVE-2026-91959 →CVE-2026-121386 →CVE-2026-121951 →CVE-2026-121954 →CVE-2026-121956 →CVE-2026-121962 →CVE-2026-121963 →CVE-2026-91945 →CVE-2026-91950 →CVE-2026-91963 →CVE-2026-111381 →CVE-2026-114045 →CVE-2026-121394 →CVE-2026-121950 →CVE-2026-121964 →CVE-2026-91948 →CVE-2026-91956 →CVE-2026-91960 →CVE-2026-110830 →CVE-2026-121402 →CVE-2026-91953 →CVE-2026-109676 →CVE-2026-110833 →CVE-2026-110838 →CVE-2026-111379 →CVE-2026-111880 →CVE-2026-121957 →CVE-2026-121961 →CVE-2026-111378 →CVE-2026-111382 →CVE-2026-121952 →CVE-2026-121958 →CVE-2026-121960 →CVE-2026-91947 →CVE-2026-121404 →CVE-2026-121959 →CVE-2026-91946 →CVE-2026-91949 →CVE-2026-91964 →CVE-2026-110837 →CVE-2026-110839 →CVE-2026-121955 →CVE-2026-91951 →CVE-2026-91954 →CVE-2026-109242 →CVE-2026-121388 →

📋 Description

CVE-2026-85089 — FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU CVE-2026-91945 — FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing CVE-2026-91946 — FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU CVE-2026-91947 — FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption CVE-2026-91948 — FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL CVE-2026-91949 — freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass CVE-2026-91950 — FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure CVE-2026-91951 — FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel CVE-2026-91953 — FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. CVE-2026-91954 — FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91956 — FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel CVE-2026-91959 — FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway CVE-2026-91960 — FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR CVE-2026-91963 — FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure CVE-2026-91964 — FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU CVE-2026-109242 — freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109676 — freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect CVE-2026-110830 — freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling CVE-2026-110833 — freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly CVE-2026-110837 — freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding CVE-2026-110838 — freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch CVE-2026-110839 — freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion CVE-2026-111378 — freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser CVE-2026-111379 — freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file CVE-2026-111381 — freerdp: freerdp: Arbitrary code execution via crafted persistent cache file CVE-2026-111382 — freerdp: freerdp: Arbitrary code execution via crafted display frames CVE-2026-111880 — freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication CVE-2026-114045 — freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats CVE-2026-121386 — freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads CVE-2026-121388 — freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels CVE-2026-121394 — freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder CVE-2026-121402 — freerdp: freerdp: Denial of Service via zero-width graphics reset CVE-2026-121404 — freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages CVE-2026-121950 — freerdp: FreeRDP: Heap buffer overflow via integer overflow in surface creation CVE-2026-121951 — freerdp: FreeRDP: Denial of Service via truncated input event CVE-2026-121952 — freerdp: freerdp: Out-of-bounds write in proxy bitmap cache v2 capability handling CVE-2026-121953 — freerdp: freerdp: Use-after-free via rdpgfx dynamic virtual channel close CVE-2026-121954 — freerdp: freerdp: Denial of Service via heap out-of-bounds write in planar codec CVE-2026-121955 — freerdp: freerdp: Denial of Service via use-after-free in smartcard emulation CVE-2026-121956 — freerdp: freerdp: Denial of Service via crafted Kerberos authentication request CVE-2026-121957 — freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding CVE-2026-121958 — freerdp: FreeRDP: Heap-based buffer overflow via surface key truncation in RDPGFX CVE-2026-121959 — freerdp: freerdp: Denial of Service via infinite loop on truncated WebSocket frame CVE-2026-121960 — freerdp: freerdp: Denial of Service via missing negotiation tokens in CredSSP request CVE-2026-121961 — freerdp: FreeRDP: Denial of Service via dynamic channel race condition in proxy CVE-2026-121962 — freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization CVE-2026-121963 — freerdp: freerdp: Denial of Service via dynamic audio channel use-after-free CVE-2026-121964 — freerdp: freerdp: Arbitrary code execution via RD Gateway RPC client heap buffer overflow

🎯 Affected products67

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-debugsource-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-devel-2:3.32.2-1.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freerdp-libs-2:3.32.2-1.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +37 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable smartcard redirection when connecting to RDP servers using FreeRDP. This can typically be achieved by using the `--disable-smartcard` command-line option for `xfreerdp` or similar configuration in other FreeRDP-based clients. Disabling smartcard redirection may impact functionality that relies on smartcard authentication or access within the RDP session. Workaround: To mitigate this issue, restrict network access to FreeRDP server instances to only trusted clients and networks. Configure firewall rules to limit inbound connections to the RDP port (typically 3389) from untrusted sources. If FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component. Workaround: The vulnerability requires an authenticated client to interact with the FreeRDP server. To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients and networks. If the FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component to eliminate the attack surface. Workaround: To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients or localhost. This can be achieved by configuring firewall rules to limit inbound connections to the FreeRDP service port. A restart of the FreeRDP server may be required for network configuration changes to take effect. Workaround: To mitigate this issue, users should avoid connecting to untrusted or potentially malicious RDP servers. Restricting FreeRDP client connections to only known and trusted RDP servers significantly reduces the attack surface. If connecting to untrusted servers is unavoidable, consider using a highly isolated environment for the client. Workaround: To mitigate this issue, disable the USB redirection (urbdrc) client channel when connecting to untrusted RDP servers. This can typically be achieved by using the `/d:urbdrc` option with `xfreerdp` or similar FreeRDP client commands. Disabling this channel will prevent USB device redirection functionality. Workaround: To prevent exploitation of this heap buffer overflow, FreeRDP clients should only be used to connect to trusted RDP servers. This operational control reduces the risk of encountering a malicious server redirection PDU. Workaround: To mitigate this issue, users should avoid connecting to untrusted or unknown RDP servers with FreeRDP clients. This vulnerability requires a FreeRDP client to connect to a malicious RDP server to be exploited. Workaround: To mitigate this issue, users should avoid connecting to untrusted or unverified RDP servers. Restricting FreeRDP client connections to known, trusted RDP servers can prevent exploitation of this vulnerability. Workaround: To mitigate this issue, restrict network access to any FreeRDP instance operating in a server or gateway role, limiting connections to trusted clients or networks. If FreeRDP is used as a client, avoid connecting to untrusted or malicious RDP servers to prevent exploitation. Workaround: To mitigate this issue, FreeRDP clients should only connect to trusted and verified Remote Desktop Gateway servers. Connecting to untrusted or unverified servers may expose the client to denial of service attacks. Workaround: To reduce exposure, avoid connecting to untrusted RDP servers or disable the FreeRDP USB redirection channel if it is not required. When using the `xfreerdp` client, ensure that USB redirection is not enabled. This can be done by omitting the `/usb` or `/usb-redir` command-line options, or by explicitly disabling the `urbdrc` channel through FreeRDP configuration if available. Disabling this feature will prevent the redirection of USB devices to the remote session. Workaround: Users of FreeRDP clients should avoid connecting to untrusted or unknown RDP servers. This operational control reduces the risk of exploitation, as a malicious server is required to trigger the heap-based buffer overflow. Workaround: If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers. Workaround: Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers. Workaround: If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers. Workaround: Do not expose freerdp-shadow-cli to untrusted networks. Restrict access with host firewalling and require authentication. Workaround: If clipboard redirection is unused, disable it. Restrict FreeRDP clients to trusted servers. Workaround: Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required. 1. Restrict RDP access to trusted network sources using firewalld: # firewall-cmd --permanent --zone=public --remove-service=rdp # firewall-cmd --permanent --zone=trusted --add-source=<trusted_IP_or_CIDR> # firewall-cmd --reload 2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop): # systemctl --user --now mask gnome-remote-desktop.service Caveats and Warnings: Reloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity. Workaround: Do not expose FreeRDP server or proxy endpoints that use SspiNtlmHashCallback to untrusted networks; restrict access with a host firewall and network segmentation. If the NTLM hash callback is not required, leave it unset so the vulnerable MIC path is not entered. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds validation on Message Integrity Check (MIC) offsets within the authenticate message buffer before writing in ntlm_computeMicValue: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which validate that the MIC offset is within the authenticate message buffer bounds before writing bytes, closing crafted NTLM AUTHENTICATE_MESSAGE with backward session-key offset and out-of-bounds MIC offset. Until patched, this is a concern on FreeRDP server and proxy instances configured with the non-default SspiNtlmHashCallback setting, so leave SspiNtlmHashCallback unset if NTLM hash callbacks are not required, and restrict network access to FreeRDP endpoints from untrusted networks using firewalls and network segmentation. As a compensating measure, configure systemd service restart and watchdog settings to automatically restart FreeRDP upon process crashes and mitigate prolonged denial of service, require pre-authentication through a zero-trust gateway or identity-aware proxy before clients can reach the FreeRDP NTLM authentication handler, and restrict FreeRDP port access with host firewalls using firewalld or nftables to isolate the service from untrusted networks. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds write defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 …

🔗 References (36)