ALAS2023-2026-3342

References: CVE-2026-114043  CVE-2026-114045  CVE-2026-114046  CVE-2026-114047 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory. (CVE-2026-114043)

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution. (CVE-2026-114045)

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process. (CVE-2026-114046)

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data. (CVE-2026-114047)

Issue Correction:
Run dnf update freerdp --releasever 2023.12.20261029 or dnf update --advisory ALAS2023-2026-3342 --releasever 2023.12.20261029 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    freerdp-server-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-libs-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-libs-3.32.2-1.amzn2023.aarch64
    libwinpr-debuginfo-3.32.2-1.amzn2023.aarch64
    freerdp-devel-3.32.2-1.amzn2023.aarch64
    freerdp-3.32.2-1.amzn2023.aarch64
    freerdp-debugsource-3.32.2-1.amzn2023.aarch64
    freerdp-server-3.32.2-1.amzn2023.aarch64
    libwinpr-devel-3.32.2-1.amzn2023.aarch64
    freerdp-debuginfo-3.32.2-1.amzn2023.aarch64
    libwinpr-3.32.2-1.amzn2023.aarch64

src:
    freerdp-3.32.2-1.amzn2023.src

x86_64:
    libwinpr-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-libs-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-debuginfo-3.32.2-1.amzn2023.x86_64
    libwinpr-3.32.2-1.amzn2023.x86_64
    libwinpr-devel-3.32.2-1.amzn2023.x86_64
    freerdp-server-debuginfo-3.32.2-1.amzn2023.x86_64
    freerdp-devel-3.32.2-1.amzn2023.x86_64
    freerdp-debugsource-3.32.2-1.amzn2023.x86_64
    freerdp-libs-3.32.2-1.amzn2023.x86_64
    freerdp-server-3.32.2-1.amzn2023.x86_64
    freerdp-3.32.2-1.amzn2023.x86_64