RHSA-2026:60173: Important: freerdp security update

Q: Which deployments are exposed to these issues?

Deployments using FreeRDP, including the xfreerdp client, are relevant. The client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Q: What attacker-controlled input is identified for the code-execution and denial-of-service issues?

The advisory identifies malicious RDP files as an input for arbitrary code execution, crafted WindowIcon asynchronous messages for denial of service, and audio input that can trigger an integer overflow leading to remote code execution or denial of service.

Q: Are any affected supporting libraries included in the update?

Yes. The listed software includes freerdp, freerdp-libs, libwinpr, and associated development, debuginfo, and debugsource packages.

Published Aug 26, 2026

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.Security Fix(es): FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

18 affected componentsFixes available

Red Hat Red Hat Enterprise Linux Server - AUS

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life

redhat/freerdp<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-debugsource<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-debugsource<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-libs<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-libs<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-libs-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/freerdp-libs-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr-debuginfo<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr-devel<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

redhat/libwinpr-devel<2.2.0-14.el8_4.2

2.2.0-14.el8_4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/freerdp-debuginfo to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/freerdp-debugsource to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/freerdp-libs to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/freerdp-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/libwinpr to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/libwinpr-debuginfo to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2
Upgrade
Upgrade redhat/libwinpr-devel to a version that resolves this vulnerability.
Fixed in 2.2.0-14.el8_4.2

Event History

Aug 26, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·09:15 AM

Data Sourced

via Red Hat·09:15 AM

Severity

Frequently Asked Questions

Which deployments are exposed to these issues?

Deployments using FreeRDP, including the xfreerdp client, are relevant. The client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

What attacker-controlled input is identified for the code-execution and denial-of-service issues?

The advisory identifies malicious RDP files as an input for arbitrary code execution, crafted WindowIcon asynchronous messages for denial of service, and audio input that can trigger an integer overflow leading to remote code execution or denial of service.

Are any affected supporting libraries included in the update?

Yes. The listed software includes freerdp, freerdp-libs, libwinpr, and associated development, debuginfo, and debugsource packages.

RHSA-2026:60173: Important: freerdp security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to these issues?

What attacker-controlled input is identified for the code-execution and denial-of-service issues?

Are any affected supporting libraries included in the update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to these issues?

What attacker-controlled input is identified for the code-execution and denial-of-service issues?

Are any affected supporting libraries included in the update?