ALAS2023-2026-3342

References: CVE-2026-114043  CVE-2026-114045  CVE-2026-114046  CVE-2026-114047 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Fix GHSA-66mr-7wc7-23vc: FreeRDP client can abort while logging a malformed RDPDR device announcement

Fix GHSA-x7w3-32ch-x2jq: winpr image conversion: heap over-read encoding 16 bpp DIBs to PNG; malformed PNG/JPEG abort or exit the process

Fix GHSA-fqw6-jf2h-6fj6: RDPGFX ALPHA `WIRETOSURFACE_2` command can abort a FreeRDP client

Fix GHSA-m7xq-5f7v-hjvw: FreeRDP proxy has no cumulative limit for intercepted DVC message reassembly

Fix GHSA-2557-79qc-6gfr: FreeRDP WinPR Kerberos SSPI retrieveSomeTgt double free of the default realm

Fix GHSA-jqf4-4p68-4p43: Opted-in GLYPH_INDEX client abort from unrepresentable background width

Fix GHSA-r387-jjq3-87hv: Serial RDPDR device-control output length can exhaust FreeRDP client memory

Fix GHSA-8rjm-m7xg-mg6m: RD Gateway extended-auth packet crashes FreeRDP client before tunnel authentication

Fix GHSA-cx9c-q4jc-wm6c: Dynamic rdpsnd channel close leaves playback thread using a freed callback

Fix GHSA-983v-jp34-f3fm: FreeRDP smartcard emulation: use-after-free in ReleaseContext racing in-flight GetStatusChange

Fix GHSA-8g9g-hqqp-fw69: FreeRDP client leaks file descriptors on repeated parallel-device CREATE requests, allowing a hostile RDP server to exhaust the client process

Fix GHSA-f53w-3364-jr35: FreeRDP RDPGFX CREATE_SURFACE integer wrap causes a 32-bit heap overwrite

Fix GHSA-x8vp-ff7m-294g: Authenticated remdesk channel payload aborts FreeRDP shadow server through stream-capacity assertion

Fix GHSA-m59q-wm7v-mp57: FreeRDP RDPGFX client: heap out-of-bounds write in HashTable_GetKeys via surface-key truncation

Fix GHSA-j536-qc58-pmf8: Partial Early User Authorization reads can overflow a FreeRDP client receive buffer

Fix GHSA-wg7g-gx9g-r96c: FreeRDP truncated GSM610/WAV49 audio causes an out-of-bounds read

Fix GHSA-799q-hjgw-g55g: WinPR image readers abort/exit the client process on malformed PNG/JPEG (missing library error handling)

Fix GHSA-x26g-fp9v-c2pg: FreeRDP WebSocket client spins indefinitely when TLS closes during a frame payload

Fix GHSA-6wqx-rv3q-vcxp: FreeRDP client use-after-free in the rdpgfx dynamic virtual channel on channel close

Fix GHSA-2c9x-4gr7-hrwx: Zero-output ZGFX payload aborts FreeRDP RDPGFX clients

Fix GHSA-fqcj-rwww-2498: Zero-length dynamic-channel DATA messages can spin FreeRDP shadow-server threads

Fix GHSA-q82v-5wjg-6h57: FreeRDP RD Gateway RPC client heap buffer overflow in rpc_client_recv_fragment

Fix GHSA-5qqp-5ffm-m3p9: Malformed drive request silently stops FreeRDP's drive worker and leaves later requests queued

Fix GHSA-qw7w-hhxq-763c: FreeRDP proxy DRDYNVC tracker race causes use-after-free and process crash

Fix GHSA-3pg4-5r42-wxvj: Unauthenticated shadow-server abort on TSRequest without negoTokens

Fix GHSA-4vh4-3pc3-32p7: RD Gateway packet length causes 2 GiB client allocation before tunnel authentication

Fix GHSA-xc85-4mqc-xgcx: FreeRDP proxy out-of-bounds write in bitmap cache v2 capability handling

Fix GHSA-w897-ffhv-5j7g: USB redirection control-channel close can race a channel write in FreeRDP

Fix GHSA-v85m-wg84-5ffh: FreeRDP URBDRC frees active libusb transfers during teardown

Fix GHSA-x4x6-2hrm-hvq9: RD Gateway control packet can make FreeRDP client spin at full CPU

Fix GHSA-jq25-3374-4262: Incomplete fix for GHSA-43hh-p3vw-hfx3: CN-fallback and IP-literal cert identity checks were never patched

Fix GHSA-fg78-v8j5-8697: FreeRDP planar codec: non-atomic geometry and buffer update on failed ResetGraphics causes heap out-of-bounds write

Fix GHSA-rrp5-666j-g6gp: FreeRDP DRDYNVC DATA_FIRST length causes an uncapped client allocation

Fix GHSA-c426-ppvf-jpfg: Zero-width RDPGFX ResetGraphics causes a later FreeRDP X11 client crash

Fix GHSA-xjhw-2r55-m95g: FreeRDP planar bitmap decode: RDPGFX ResetGraphics race causes use-after-free of shared planar buffers

Fix GHSA-v3q2-qjvf-7rqw: FreeRDP proxy dyn-channel-dump session teardown causes cross-thread use-after-free

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory. (CVE-2026-114043)

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution. (CVE-2026-114045)

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process. (CVE-2026-114046)

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data. (CVE-2026-114047)

Issue Correction:
Run dnf update freerdp --releasever 2023.12.20261029 or dnf update --advisory ALAS2023-2026-3342 --releasever 2023.12.20261029 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    freerdp-server-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-libs-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-libs-3.32.2-1.amzn2023.aarch64
    libwinpr-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-devel-3.32.2-1.amzn2023.aarch64
    freerdp-3.32.2-1.amzn2023.aarch64
    freerdp-debugsource-3.32.2-1.amzn2023.aarch64
    freerdp-server-3.32.2-1.amzn2023.aarch64
    libwinpr-devel-3.32.2-1.amzn2023.aarch64
    freerdp-debuginfo-3.32.2-1.amzn2023.aarch64
    libwinpr-3.32.2-1.amzn2023.aarch64

src:
    freerdp-3.32.2-1.amzn2023.src

x86_64:
    libwinpr-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-libs-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-debuginfo-3.32.2-1.amzn2023.x86_64
    libwinpr-3.32.2-1.amzn2023.x86_64
    libwinpr-devel-3.32.2-1.amzn2023.x86_64
    freerdp-server-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-devel-3.32.2-1.amzn2023.x86_64
    freerdp-debugsource-3.32.2-1.amzn2023.x86_64
    freerdp-libs-3.32.2-1.amzn2023.x86_64
    freerdp-server-3.32.2-1.amzn2023.x86_64
    freerdp-3.32.2-1.amzn2023.x86_64