1. Ubuntu Security Notices
  2. USN-8042-1

USN-8042-1: FreeRDP vulnerabilities

Publication date

16 February 2026

Overview

Several security issues were fixed in FreeRDP.

Releases

Packages

  • freerdp2 - RDP client for Windows Terminal Services
  • freerdp3 - RDP client for Windows Terminal Services

Details

It was discovered that FreeRDP incorrectly handled memory under certain
circumstances, which could lead to a NULL pointer dereference. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-23948)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu
25.10. (CVE-2026-24491)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-24675,

It was discovered that FreeRDP incorrectly handled memory under certain
circumstances, which could lead to a NULL pointer dereference. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-23948)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu
25.10. (CVE-2026-24491)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-24675, CVE-2026-24679, CVE-2026-24682)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2026-24676,
CVE-2026-24681)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 25.10. (CVE-2026-24677)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
Ubuntu 25.10. (CVE-2026-24678)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24680)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2026-24683, CVE-2026-24684)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
25.10 questing freerdp3-x11 –  3.16.0+dfsg-2ubuntu0.1
libfreerdp3-3 –  3.16.0+dfsg-2ubuntu0.1
24.04 LTS noble freerdp2-x11 –  2.11.5+dfsg1-1ubuntu0.1~esm5  
freerdp3-x11 –  3.5.1+dfsg1-0ubuntu1.2
libfreerdp2-2t64 –  2.11.5+dfsg1-1ubuntu0.1~esm5  
libfreerdp3-3 –  3.5.1+dfsg1-0ubuntu1.2
22.04 LTS jammy freerdp2-x11 –  2.6.1+dfsg1-3ubuntu2.10
libfreerdp2-2 –  2.6.1+dfsg1-3ubuntu2.10
20.04 LTS focal freerdp2-x11 –  2.6.1+dfsg1-0ubuntu0.20.04.2+esm3  
libfreerdp2-2 –  2.6.1+dfsg1-0ubuntu0.20.04.2+esm3  
18.04 LTS bionic freerdp2-x11 –  2.2.0+dfsg1-0ubuntu0.18.04.4+esm5  
libfreerdp2-2 –  2.2.0+dfsg1-0ubuntu0.18.04.4+esm5  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›