RLSA-2026:97219: Moderate: freerdp security, bug fix, and enhancement update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
freerdp: FreeRDP: Denial of Service via endless blocking loop in StreamEnsureCapacity (CVE-2026-27951)
Bug Fix(es) and Enhancement(s):
Update freerdp to the latest upstream stable release (JIRA:Rocky Linux-80426)
FreeRDP does not create context for hostnames longer than 31 characters (JIRA:Rocky Linux-143809)
SSL warnings under FIPS (JIRA:Rocky Linux-140202)
[RFE] Add RDP Smart Card Redirection Support (MS?RDPESC) to Enable Remote (Virtualized) SmartCard?Based PKINIT Authentication (JIRA:Rocky Linux-171999)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/freerdp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/libwinpr-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/libwinpr-develto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-debugsourceto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-serverto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdpto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-libsto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/libwinprto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-develto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3 - Upgrade
Upgrade
rocky-linux/freerdp-server-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.28.0-4.el10_3
Event History
Frequently Asked Questions
What would an attacker need to do to exploit this issue?
The issue is remotely reachable and requires no privileges or user interaction, but exploitation has high attack complexity. The disclosed impact is denial of service through an endless blocking loop in Stream_EnsureCapacity.
Which systems are exposed?
Systems using the affected FreeRDP components are relevant, including the xfreerdp client and FreeRDP server packages listed in the advisory. The provided information does not state whether any particular default configuration is affected.
How can I determine whether this update applies to a system?
Check whether Rocky Linux FreeRDP packages are installed, particularly freerdp, freerdp-server, freerdp-libs, libwinpr-devel, or their associated debug packages. The advisory does not provide affected or fixed package version numbers.