Detections
Analytics

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3342)

high Nessus Plugin ID 373914

Language:

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3342 advisory.

 Fix GHSA-66mr-7wc7-23vc: FreeRDP client can abort while logging a malformed RDPDR device announcement

 Fix GHSA-x7w3-32ch-x2jq: winpr image conversion: heap over-read encoding 16 bpp DIBs to PNG; malformed PNG/JPEG abort or exit the process

 Fix GHSA-fqw6-jf2h-6fj6: RDPGFX ALPHA `WIRETOSURFACE_2` command can abort a FreeRDP client

 Fix GHSA-m7xq-5f7v-hjvw: FreeRDP proxy has no cumulative limit for intercepted DVC message reassembly

 Fix GHSA-2557-79qc-6gfr: FreeRDP WinPR Kerberos SSPI retrieveSomeTgt double free of the default realm

 Fix GHSA-jqf4-4p68-4p43: Opted-in GLYPH_INDEX client abort from unrepresentable background width

 Fix GHSA-r387-jjq3-87hv: Serial RDPDR device-control output length can exhaust FreeRDP client memory

 Fix GHSA-8rjm-m7xg-mg6m: RD Gateway extended-auth packet crashes FreeRDP client before tunnel authentication

 Fix GHSA-cx9c-q4jc-wm6c: Dynamic rdpsnd channel close leaves playback thread using a freed callback

 Fix GHSA-983v-jp34-f3fm: FreeRDP smartcard emulation: use-after-free in ReleaseContext racing in-flight GetStatusChange

 Fix GHSA-8g9g-hqqp-fw69: FreeRDP client leaks file descriptors on repeated parallel-device CREATE requests, allowing a hostile RDP server to exhaust the client process

 Fix GHSA-f53w-3364-jr35: FreeRDP RDPGFX CREATE_SURFACE integer wrap causes a 32-bit heap overwrite

 Fix GHSA-x8vp-ff7m-294g: Authenticated remdesk channel payload aborts FreeRDP shadow server through stream-capacity assertion

 Fix GHSA-m59q-wm7v-mp57: FreeRDP RDPGFX client: heap out-of-bounds write in HashTable_GetKeys via surface- key truncation

 Fix GHSA-j536-qc58-pmf8: Partial Early User Authorization reads can overflow a FreeRDP client receive buffer

 Fix GHSA-wg7g-gx9g-r96c: FreeRDP truncated GSM610/WAV49 audio causes an out-of-bounds read

 Fix GHSA-799q-hjgw-g55g: WinPR image readers abort/exit the client process on malformed PNG/JPEG (missing library error handling)

 Fix GHSA-x26g-fp9v-c2pg: FreeRDP WebSocket client spins indefinitely when TLS closes during a frame payload

 Fix GHSA-6wqx-rv3q-vcxp: FreeRDP client use-after-free in the rdpgfx dynamic virtual channel on channel close

 Fix GHSA-2c9x-4gr7-hrwx: Zero-output ZGFX payload aborts FreeRDP RDPGFX clients

 Fix GHSA-fqcj-rwww-2498: Zero-length dynamic-channel DATA messages can spin FreeRDP shadow-server threads

 Fix GHSA-q82v-5wjg-6h57: FreeRDP RD Gateway RPC client heap buffer overflow in rpc_client_recv_fragment

 Fix GHSA-5qqp-5ffm-m3p9: Malformed drive request silently stops FreeRDP's drive worker and leaves later requests queued

 Fix GHSA-qw7w-hhxq-763c: FreeRDP proxy DRDYNVC tracker race causes use-after-free and process crash

 Fix GHSA-3pg4-5r42-wxvj: Unauthenticated shadow-server abort on TSRequest without negoTokens

 Fix GHSA-4vh4-3pc3-32p7: RD Gateway packet length causes 2 GiB client allocation before tunnel authentication

 Fix GHSA-xc85-4mqc-xgcx: FreeRDP proxy out-of-bounds write in bitmap cache v2 capability handling

 Fix GHSA-w897-ffhv-5j7g: USB redirection control-channel close can race a channel write in FreeRDP

 Fix GHSA-v85m-wg84-5ffh: FreeRDP URBDRC frees active libusb transfers during teardown

 Fix GHSA-x4x6-2hrm-hvq9: RD Gateway control packet can make FreeRDP client spin at full CPU

 Fix GHSA-jq25-3374-4262: Incomplete fix for GHSA-43hh-p3vw-hfx3: CN-fallback and IP-literal cert identity checks were never patched

 Fix GHSA-fg78-v8j5-8697: FreeRDP planar codec: non-atomic geometry and buffer update on failed ResetGraphics causes heap out-of-bounds write

 Fix GHSA-rrp5-666j-g6gp: FreeRDP DRDYNVC DATA_FIRST length causes an uncapped client allocation

 Fix GHSA-c426-ppvf-jpfg: Zero-width RDPGFX ResetGraphics causes a later FreeRDP X11 client crash

 Fix GHSA-xjhw-2r55-m95g: FreeRDP planar bitmap decode: RDPGFX ResetGraphics race causes use-after-free of shared planar buffers

 Fix GHSA-v3q2-qjvf-7rqw: FreeRDP proxy dyn-channel-dump session teardown causes cross-thread use-after- free



 FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory. (CVE-2026-114043)

 FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution. (CVE-2026-114045)

 FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.
 (CVE-2026-114046)

 FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network- positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong- hostname certificate to impersonate the RDP target and receive proxied session data. (CVE-2026-114047)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update freerdp --releasever 2023.12.20261029' or or 'dnf update --advisory ALAS2023-2026-3342 --releasever 2023.12.20261029' to update your system.

See Also

https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3342.html

https://alas.aws.amazon.com/faqs.html

https://explore.alas.aws.amazon.com/CVE-2026-114043.html

https://explore.alas.aws.amazon.com/CVE-2026-114045.html

https://explore.alas.aws.amazon.com/CVE-2026-114046.html

https://explore.alas.aws.amazon.com/CVE-2026-114047.html

Plugin Details

Severity: High

ID: 373914

File Name: al2023_ALAS2023-2026-3342.nasl

Version: 1.2

Type: Local

Agent: unix

Published: 10/29/2026

Updated: 10/30/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.51

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-114045

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:freerdp-debuginfo, p-cpe:/a:amazon:linux:freerdp-debugsource, p-cpe:/a:amazon:linux:freerdp-devel, p-cpe:/a:amazon:linux:freerdp-libs-debuginfo, p-cpe:/a:amazon:linux:freerdp-libs, p-cpe:/a:amazon:linux:freerdp-server-debuginfo, p-cpe:/a:amazon:linux:freerdp-server, p-cpe:/a:amazon:linux:freerdp, p-cpe:/a:amazon:linux:libwinpr-debuginfo, p-cpe:/a:amazon:linux:libwinpr-devel, p-cpe:/a:amazon:linux:libwinpr

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-114043, CVE-2026-114045, CVE-2026-114046, CVE-2026-114047