Loading story…
FreeRDP released version 3.27.0 with a stronger default transport posture and several security fixes across client and server components. The update raises the default OpenSSL TLS security level to 2 and now requires a minimum of TLS 1.2, aligning remote desktop connections with stricter cryptographic standards documented by OpenSSL. The release also incorporates fixes associated with multiple GitHub Security Advisories and additional vulnerability reports from Tencent Keen Lab and another researcher.
The patched issues include validation and bounds-checking flaws in RD Gateway authentication blob handling, negotiation cookie parsing, glyph cache offset reads, and graphics header parsing. FreeRDP also fixed a server-side denial-of-service condition in the rdpsnd channel by rejecting invalid client audio formats. Alongside the security changes, the release adds Android client improvements, Azure/Entra connection stability updates, keyboard mapping changes, statistics logging APIs, and numerous fixes across channels, proxy functions, clients, and the build system.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
On 15 June 2026, FreeRDP released version 3.27.0, described as a major feature, bugfix, and cleanup release. The update raised the default TLS security level to 2, required at least TLS 1.2, and fixed multiple security issues including validation, bounds-checking, and a server-side rdpsnd denial-of-service condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity double-free vulnerability tracked as **`CVE-2026-64621`** was disclosed in **FreeRDP** versions **3.x through 3.27.1**, affecting the parsing of the `selectedmonitors` field in `.rdp` connection files. The flaw is located in `freerdp_client_rdp_file_apply_to_settings()` in `client/common/file.c`, where an error path can free a non-owning pointer and leave `settings->MonitorIds` dangling, leading to a second free during teardown. The issue is classified as **CWE-415** and can affect FreeRDP CLI clients including **`xfreerdp`**, **`sdl-freerdp`**, and **`wlfreerdp`** in their default configurations. Attackers could exploit the bug by persuading a user to open a crafted `.rdp` file containing oversized monitor tokens, resulting in a size-controlled double-free with potential impacts to **integrity** and **availability**, and limited **confidentiality** exposure under the published CVSS assessment. The vulnerability has been fixed in **FreeRDP 3.28.0**, and public references include a GitHub security advisory, a fixing commit in the FreeRDP repository, and a VulnCheck advisory.
Jul 20, 2026
Red Hat released **Important** security updates for `freerdp` across multiple Red Hat Enterprise Linux product streams, including **RHEL 8, 9, and 10**, SAP Solutions channels, Extended Update Support, and related builder repositories. The advisories address four prominently tracked vulnerabilities: **`CVE-2026-64624`**, which allows arbitrary code execution through malicious `.rdp` files parsed as raw command-line options; **`CVE-2026-67299`**, a client-side heap use-after-free in asynchronous `WINDOW_ICON_ORDER` handling that can crash a client; **`CVE-2026-67289`**, which lets a malicious RDP server inject arbitrary headers or requests into an HTTP proxy `CONNECT` request via a crafted redirection target; and **`CVE-2026-68580`**, an integer overflow in audio input redirection that can cause remote code execution or denial of service. Updated packages were published in several streams, including **`2.11.7-11.el8_10`** for RHEL 8, **`2.11.7-7.el9_8.5`**, **`2.11.7-1.el9_6.12`**, **`2.11.2-1.el9_4.10`**, and **`2.4.1-6.el9_2.11`** for RHEL 9 variants, and **`3.10.3-12.el10_2.8`** and **`3.10.3-3.el10_0.11`** for RHEL 10 channels. Red Hat said the flaws can be triggered by malicious or compromised RDP servers, crafted redirection data, or specially prepared RDP files, with impacts ranging from client crashes and proxy abuse to heap corruption and code execution on affected systems.
Sep 4, 2026
FreeRDP 3.31.0 fixes 22 security vulnerabilities, including a three-flaw chain that can yield **pre-authentication remote code execution** against GNOME Remote Desktop (GRD) Remote Login deployments. The demonstrated chain bypasses system-wide remote-login authentication, uses an `RDPGFX ResetGraphics` message to disclose uninitialized heap memory, and triggers an out-of-bounds write during `RDPDR` device-redirection channel processing to control an indirect function call. The resulting shell runs under a temporary `gdm-greeter-N` account rather than root, but testing found that account was not sandboxed on affected Fedora and Ubuntu configurations. The complete exploit path has limited exposure because it requires GRD 51 or later with `RDPDR` enabled; however, organizations should update FreeRDP and embedded distributions to 3.31.0 promptly. The release also remediates issues across graphics decoding, dynamic virtual channels, RD Gateway parsing, clipboard, smart-card, USB/device redirection, memory management, and authentication/error-handling components.
Sep 10, 2026