Ubuntu releases security updates for FreeRDP to address multiple vulnerabilities

Ubuntu has issued security notices (USN-9007-1) to address a significant number of vulnerabilities discovered in the FreeRDP project. These flaws affect the RDP client used for connecting to Windows Terminal Services, posing risks ranging from application crashes to full system compromise.

The updates are available for Ubuntu 26.10, 26.04 LTS, and 24.04 LTS. The patches involve moving to a new upstream release of FreeRDP that includes these security fixes along with additional bug fixes to stabilize the client.

Vulnerability details and affected packages

• Security Risks: The identified vulnerabilities could allow a remote attacker to execute arbitrary code, trigger a denial of service (DoS) via application crashes, or gain unauthorized access to sensitive information.
• Affected Components: The security updates impact the core library libfreerdp3-3 as well as the Wayland and X11 client implementations (freerdp-wayland, freerdp-x11, freerdp3-wayland, and freerdp3-x11).
• Version Fixes: Users on Ubuntu 26.04 LTS and 26.10 should update to version 3.32.2+dfsg-0ubuntu0.26.10.1 or 3.32.2+dfsg-0ubuntu0.26.04.1 respectively, while 24.04 LTS users require version 3.32.2+dfsg-0ubuntu0.24.04.1.
• CVE Scope: The advisory references a large volume of CVEs, including CVE-2026-121412 through CVE-2026-121386 and many others, indicating a broad range of addressed flaws.

Why it matters

Because FreeRDP is a primary tool for Linux users to access Windows environments, these vulnerabilities represent a significant risk for remote desktop users and system administrators. Promptly updating the FreeRDP packages is essential to prevent potential remote code execution during RDP sessions.