RLSA-2026:54486

Synopsis

Important: freerdp security update

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)

* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)

* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)

* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)

* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)

* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2509985 2502752 2510004 2503096 2502766 2510125

CVEs

CVE-2026-64620 CVE-2026-64621 CVE-2026-64624 CVE-2026-67289 CVE-2026-67299 CVE-2026-68580

Affected packages

Rocky Linux 10 s390x - AppStream

freerdp-debugsource-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-debuginfo-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-2:3.10.3-12.el10_2.8.src.rpm freerdp-libs-2:3.10.3-12.el10_2.8.s390x.rpm libwinpr-debuginfo-2:3.10.3-12.el10_2.8.s390x.rpm libwinpr-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-libs-debuginfo-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-2:3.10.3-12.el10_2.8.s390x.rpm

Rocky Linux 10 aarch64 - CRB

freerdp-devel-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-server-debuginfo-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-server-2:3.10.3-12.el10_2.8.aarch64.rpm libwinpr-devel-2:3.10.3-12.el10_2.8.aarch64.rpm

Rocky Linux 10 x86_64 - AppStream

freerdp-libs-debuginfo-2:3.10.3-12.el10_2.8.x86_64.rpm libwinpr-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-2:3.10.3-12.el10_2.8.src.rpm freerdp-debuginfo-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-libs-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-2:3.10.3-12.el10_2.8.x86_64.rpm libwinpr-debuginfo-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-debugsource-2:3.10.3-12.el10_2.8.x86_64.rpm

Rocky Linux 10 aarch64 - AppStream

libwinpr-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-2:3.10.3-12.el10_2.8.src.rpm freerdp-libs-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-debugsource-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-libs-debuginfo-2:3.10.3-12.el10_2.8.aarch64.rpm libwinpr-debuginfo-2:3.10.3-12.el10_2.8.aarch64.rpm freerdp-debuginfo-2:3.10.3-12.el10_2.8.aarch64.rpm

Rocky Linux 10 x86_64 - CRB

freerdp-devel-2:3.10.3-12.el10_2.8.x86_64.rpm libwinpr-devel-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-server-2:3.10.3-12.el10_2.8.x86_64.rpm freerdp-server-debuginfo-2:3.10.3-12.el10_2.8.x86_64.rpm

Rocky Linux 10 ppc64le - AppStream

freerdp-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-2:3.10.3-12.el10_2.8.src.rpm libwinpr-debuginfo-2:3.10.3-12.el10_2.8.ppc64le.rpm libwinpr-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-debugsource-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-debuginfo-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-libs-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-libs-debuginfo-2:3.10.3-12.el10_2.8.ppc64le.rpm

Rocky Linux 10 riscv64 - AppStream

freerdp-2:3.10.3-12.el10_2.8.src.rpm

Rocky Linux 10 s390x - CRB

libwinpr-devel-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-devel-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-server-2:3.10.3-12.el10_2.8.s390x.rpm freerdp-server-debuginfo-2:3.10.3-12.el10_2.8.s390x.rpm

Rocky Linux 10 ppc64le - CRB

freerdp-server-debuginfo-2:3.10.3-12.el10_2.8.ppc64le.rpm libwinpr-devel-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-server-2:3.10.3-12.el10_2.8.ppc64le.rpm freerdp-devel-2:3.10.3-12.el10_2.8.ppc64le.rpm