VulnerabilityPublished 11 May 2026

CVE-2026-25952: freerdp security update

Affects freerdpSource GCVE Database

Not known to be exploited : upgrade to 2:2.11.7-9.el8_10 when convenient.

Data as of 27 Oct 2026, 00:27 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Patch: Available – fixed in 2:2.11.7-9.el8_10

Exploitation evidence

Disclosed: evidence found.
CVE published 11 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

almalinux-8

What to do

Upgrade the AlmaLinux to 2:2.11.7-9.el8_10.

Patches and advisories

access.redhat.com/errata/RHSA-2026:16019 (opens in a new tab)

Affected software

Product	Affected	Fixed in
AlmaLinux 8freerdp	Affected <2:2.11.7-9.el8_10	Fixed in 2:2.11.7-9.el8_10
AlmaLinux 8freerdp-devel	Affected <2:2.11.7-9.el8_10	Fixed in 2:2.11.7-9.el8_10
AlmaLinux 8freerdp-libs	Affected <2:2.11.7-9.el8_10	Fixed in 2:2.11.7-9.el8_10
AlmaLinux 8libwinpr	Affected <2:2.11.7-9.el8_10	Fixed in 2:2.11.7-9.el8_10
AlmaLinux 8libwinpr-devel	Affected <2:2.11.7-9.el8_10	Fixed in 2:2.11.7-9.el8_10

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update is available and should be applied. The fixed version is 2:2.11.7-9.el8_10 or later. Users should update FreeRDP to this version to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:16019 for detailed update instructions.

Description

FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), has multiple security vulnerabilities including a use-after-free leading to denial of service (CVE-2026-25952) among others. These issues affect versions prior to 2:2.11.7-9.el8_10 and have been addressed in that fixed release. The vulnerabilities include denial of service via use-after-free, double free, endless blocking loops, heap-buffer-overflow, out-of-bounds reads, division-by-zero, and information disclosure. Red Hat has issued a security update rated as Moderate impact to address these flaws.

Impact

The vulnerabilities can lead to denial of service conditions through use-after-free, double free, blocking loops, and crafted audio data. Additionally, there is a heap-buffer-overflow and out-of-bounds reads that could potentially lead to memory corruption or information disclosure. The overall security impact is rated Moderate by Red Hat.

Summary

FreeRDP contains several security vulnerabilities affecting versions before 2:2.11.7-9.el8_10. Notably, CVE-2026-25952 is a use-after-free vulnerability that can cause denial of service. Additional vulnerabilities include double free during disconnect, endless blocking loops, heap-buffer-overflow via out-of-bounds cacheId, out-of-bounds reads in ADPCM decoders, division-by-zero in ADPCM decoders, denial of service via crafted audio data, and information disclosure via heap memory out-of-bounds read. These issues have been fixed in version 2:2.11.7-9.el8_10 as per the Red Hat advisory RHSA-2026:16019.

References

Community reviews

Loading reviews…