RLSA-2026:54486

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)
FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)
FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)
FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)
FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)
FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific

{
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:54486",
    "license": "CC-BY-4.0"
}

References

Credits

- Rocky Enterprise Software Foundation
- Red Hat

Affected packages

Rocky Linux:10 / freerdp

Package

Name: freerdp
Purl: pkg:rpm/rocky-linux/freerdp?distro=rocky-linux-10&epoch=2

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2:3.10.3-12.el10_2.8

Database specific

Show details

{
    "yum_repository": "AppStream"
}

Database specific

source

"https://storage.googleapis.com/resf-osv-data/RLSA-2026:54486.json"