Freerdp Security Update — AlmaLinux 9 (ALSA-2026:93592)

ALSA-2026:93592 updates FreeRDP on AlmaLinux 9, fixing CVE-2026-109242, CVE-2026-110837 and CVE-2026-111880 in the open-source Remote Desktop Protocol implementation. Update with dnf update freerdp and restart any RDP clients or gateway services using the library.

High 7.1 CVSS 2026-11-03

AlmaLinux 9

What this means under a SharedLicense license

FreeRDP flaws are reachable through crafted RDP server responses: a malicious or compromised RDP endpoint can attack every client that connects to it — the reverse of the usual server-side RDP threat.

Type:

security

Severity:

important

Release date:

2026-11-03

Description:

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)
* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)
* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	freerdp-2.11.7-7.el9_8.9.aarch64.rpm	5753aa5175bafefebb60e8e7f7ce5e8ba9c5ac7e1f2ae64df78570179fb95c8b
aarch64	libwinpr-devel-2.11.7-7.el9_8.9.aarch64.rpm	57d4bb3cde4400d89ba92bd6699caa3d847729302a589decad0d1840e16814ec
aarch64	libwinpr-2.11.7-7.el9_8.9.aarch64.rpm	5dfd566f315e725482e2af717e57aea5e55d5f3a850c2196cf1da5725190df9c
aarch64	freerdp-devel-2.11.7-7.el9_8.9.aarch64.rpm	88e1ef8cd703b0e223639160fcede6e86c34d0af95541ee15560c9ef9207007c
aarch64	freerdp-libs-2.11.7-7.el9_8.9.aarch64.rpm	bb42aba4647ac69a4ee5d241b20145ee24a1ecfd1d82015ab905b53622f96446
i686	libwinpr-devel-2.11.7-7.el9_8.9.i686.rpm	08c3350389dfe91f1af9379b8875c27f96610a4e0e2abff43a406eea9b0012c9
i686	libwinpr-2.11.7-7.el9_8.9.i686.rpm	1b24f416dc2234e270df05b0a91ed9cf8c209303a87080ae12b58aa434c4cb3a
i686	freerdp-libs-2.11.7-7.el9_8.9.i686.rpm	9883cd1b304589a8578e31f4090e430b1d4f013a89a3990e2dfa6bca4b03877b
i686	freerdp-devel-2.11.7-7.el9_8.9.i686.rpm	9cf62acd39311eb428d0ad6c14758d95ead1b763f26700086978cc3e530cec1d
ppc64le	libwinpr-devel-2.11.7-7.el9_8.9.ppc64le.rpm	08f9e344f91439c73b3e03861bcd26b4991c839a812d4ae4055bc7c009ec1496
ppc64le	freerdp-devel-2.11.7-7.el9_8.9.ppc64le.rpm	2d4b89cefced792f83e979633f2ae6918ceac455a4bff51ea400117a620e0647
ppc64le	freerdp-libs-2.11.7-7.el9_8.9.ppc64le.rpm	4f40d32a5eed30b071d64ee046618ff417c7ecace330699ab82c0347aee11693
ppc64le	freerdp-2.11.7-7.el9_8.9.ppc64le.rpm	86dac46d50bb07bdb6a83df3c9d827b40eb870de2d3a257b9eeb5c588c0aa180
ppc64le	libwinpr-2.11.7-7.el9_8.9.ppc64le.rpm	edb3fd21774cfe1255848c74fe1300e8c54d29c8b2de21c31f8a8a51fddc7bfb
s390x	freerdp-2.11.7-7.el9_8.9.s390x.rpm	414191979dd35dc8a2f75d91ec1d0590ac6a9cdc8898e7e8c310b79c2e1ae2d8
s390x	libwinpr-2.11.7-7.el9_8.9.s390x.rpm	85804e684bb1aa174c0c4d8fec3d471521e553d4f3defb6079577e7e0e5ec911
s390x	libwinpr-devel-2.11.7-7.el9_8.9.s390x.rpm	89e2e161fd313aaead5c64ed47742c8dea0b02dc31b32b7ab90e104aca8d397a
s390x	freerdp-libs-2.11.7-7.el9_8.9.s390x.rpm	af3df8480a2051c3281ecd93fe723b4bd8c8e9c7e31b2dcd77902568977a4030
s390x	freerdp-devel-2.11.7-7.el9_8.9.s390x.rpm	cbd580fecc4e971d8fd124157118a71af122ed7ad6e58840f7bd7459a31c0935
x86_64	libwinpr-devel-2.11.7-7.el9_8.9.x86_64.rpm	085ad4253081138ca046579d27b791b49c26e9094e36dd0357759aae80096569
x86_64	freerdp-devel-2.11.7-7.el9_8.9.x86_64.rpm	0b48e8dda08fc8a602388f77fbfd1e551d3294b7e7eb265c712934e8a5353d8d
x86_64	freerdp-libs-2.11.7-7.el9_8.9.x86_64.rpm	2eaac17e8bb8d9a3feef0ad8dfdcf3f812b1e63a33ffdf70d4351d28a08295f2
x86_64	libwinpr-2.11.7-7.el9_8.9.x86_64.rpm	9e301cb6b9d979c10a66e0667386a3ccb1dc72f4a9ea447df21d29e0310d4f3a
x86_64	freerdp-2.11.7-7.el9_8.9.x86_64.rpm	ebc58dfec61aa5196678bf99cc2b52ac468e640c7018dd7f2f097da383d6b142

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:93592?

It is AlmaLinux's FreeRDP erratum for AlmaLinux 9, fixing three CVEs (CVE-2026-109242, CVE-2026-110837, CVE-2026-111880) in the open-source RDP implementation.

Who is affected?

AlmaLinux 9 systems with FreeRDP installed — RDP clients, remote-desktop gateways and any tool linking the FreeRDP libraries to connect to Windows machines.

How do I apply the fix?

Run dnf update freerdp* and restart any RDP sessions or gateway services using the library.

Why does a client library matter on servers?

Support teams, automation and management tools connect from servers to Windows machines — a crafted server response attacks the connecting tool, which often holds credentials to many systems.

References

Security Advisories

Related Advisories

Kernel Security Update — AlmaLinux 9 (ALSA-2026:93412)

2026-11-09

Fence-Agents Security Update — AlmaLinux 9 (ALSA-2026:94500)

2026-11-04

Cockpit Security Update — AlmaLinux 9 (ALSA-2026:94533)

2026-11-04

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System