Amazon Linux 2 Security Advisory: ALAS2-2026-3162
Advisory Released Date: 2026-02-19
Advisory Updated Date: 2026-02-19
FAQs regarding Amazon Linux ALAS/CVE Severity
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23530)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23531)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client's `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23532)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23533)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23534)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23883)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23884)
Affected Packages:
freerdp
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update freerdp or yum update --advisory ALAS2-2026-3162 to update your system.
aarch64:
freerdp-2.11.7-1.amzn2.0.3.aarch64
freerdp-libs-2.11.7-1.amzn2.0.3.aarch64
freerdp-devel-2.11.7-1.amzn2.0.3.aarch64
libwinpr-2.11.7-1.amzn2.0.3.aarch64
libwinpr-devel-2.11.7-1.amzn2.0.3.aarch64
freerdp-debuginfo-2.11.7-1.amzn2.0.3.aarch64
i686:
freerdp-2.11.7-1.amzn2.0.3.i686
freerdp-libs-2.11.7-1.amzn2.0.3.i686
freerdp-devel-2.11.7-1.amzn2.0.3.i686
libwinpr-2.11.7-1.amzn2.0.3.i686
libwinpr-devel-2.11.7-1.amzn2.0.3.i686
freerdp-debuginfo-2.11.7-1.amzn2.0.3.i686
src:
freerdp-2.11.7-1.amzn2.0.3.src
x86_64:
freerdp-2.11.7-1.amzn2.0.3.x86_64
freerdp-libs-2.11.7-1.amzn2.0.3.x86_64
freerdp-devel-2.11.7-1.amzn2.0.3.x86_64
libwinpr-2.11.7-1.amzn2.0.3.x86_64
libwinpr-devel-2.11.7-1.amzn2.0.3.x86_64
freerdp-debuginfo-2.11.7-1.amzn2.0.3.x86_64