AlmaLinux 10 : freerdp (ALSA-2026:61378)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61378 advisory. FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses CVE-2026-67297 FreeRDP: FreeRDP: Memory disclosure or denial of service vi...

MiracleLinux 8 : freerdp-2.11.7-12.el8_10 (AXSA:2026-1756:28)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1756:28 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafte...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-106202)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106202 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in...

Oracle Linux 10 : ELSA-2026-61378-0: / freerdp (ELSA-2026-613780)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613780 advisory. - Backport several CVE fixes CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297,...

Vulnerability of the functions dvcman_call_on_receive() and dvcman_channel_close() in the channels/drdynvc/client/drdynvc_main.c file of the RDP client FreeRDP, which allows a intruder to gain unauthorized access to protected information

The vulnerabilities of the functions dvcmancallonreceive and dvcmanchannelclose in the file channels/drdynvc/client/drdynvcmain.c of the RDP client FreeRDP are related to synchronization errors when using a shared resource. Exploiting these vulnerabilities can allow an attacker operating remotely...

DEBIAN-CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

DEBIAN-CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

UBUNTU-CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

UBUNTU-CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

RHSA-2026:62571 Red Hat Security Advisory: freerdp security update

Bulletin has no description...

CVE-2026-85090

A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A remote attacker, acting as a malicious Remote Desktop Protocol RDP server, can exploit this by sending a specially crafted...

CVE-2026-85089

A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units PDUs u...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RLSA-2026:62571 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...

EUVD-2026-70299

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85090 FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...