Back to Security Advisories

FreeRDP Vulnerabilities — Ubuntu Security Update (USN-9007-1)

USN-9007-1 updates FreeRDP on Ubuntu, fixing 27 CVEs across the RDP client and server implementation — issues allowing sensitive-information disclosure, denial of service, or arbitrary code execution. Update: sudo apt update && sudo apt upgrade freerdp* and restart any RDP sessions or gateway services using the library.

Critical 6.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

FreeRDP parses server responses and client input across a complex protocol — code-execution class flaws there are reachable by a malicious RDP endpoint attacking every client that connects to it.

  1. Ubuntu Security Notices

  2. USN-9007-1

Publication date

9 November 2026

Overview

Several security issues were fixed in FreeRDP.

Releases


26.10


26.04 LTS


24.04 LTS

Packages

  • freerdp3 – RDP client for Windows Terminal Services

Details

It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.

It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.

Update instructions

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 freerdp-wayland – 

3.32.2+dfsg-0ubuntu0.26.10.1
freerdp-x11 – 

3.32.2+dfsg-0ubuntu0.26.10.1
freerdp3-wayland – 

3.32.2+dfsg-0ubuntu0.26.10.1
freerdp3-x11 – 

3.32.2+dfsg-0ubuntu0.26.10.1
libfreerdp3-3 – 

3.32.2+dfsg-0ubuntu0.26.10.1
26.04

LTS resolute

 freerdp-wayland – 

3.32.2+dfsg-0ubuntu0.26.04.1
freerdp-x11 – 

3.32.2+dfsg-0ubuntu0.26.04.1
freerdp3-wayland – 

3.32.2+dfsg-0ubuntu0.26.04.1
freerdp3-x11 – 

3.32.2+dfsg-0ubuntu0.26.04.1
libfreerdp3-3 – 

3.32.2+dfsg-0ubuntu0.26.04.1
24.04

LTS noble

 freerdp3-wayland – 

3.32.2+dfsg-0ubuntu0.24.04.1
freerdp3-x11 – 

3.32.2+dfsg-0ubuntu0.24.04.1
libfreerdp3-3 – 

3.32.2+dfsg-0ubuntu0.24.04.1

References

Show 17 more references
Show less references

Frequently Asked Questions

What is USN-9007-1?
It is Ubuntu's FreeRDP security notice (November 9, 2026) fixing 27 CVEs (CVE-2026-121388 through CVE-2026-121412 and others) — issues allowing sensitive-information disclosure, denial of service, or arbitrary code execution in the RDP implementation.
Who is affected?
Ubuntu systems with FreeRDP installed — RDP clients, remote-desktop gateways and any tool linking the FreeRDP libraries to connect to Windows machines.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade freerdp* and restart any RDP sessions or gateway services using the library.
Why does FreeRDP get such large batches?
The RDP protocol is enormous — dozens of channels, codecs and virtual channels each with their own parsers, and coordinated audits keep finding memory-safety issues across them, so fixes arrive as large batches.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System