Back Linuxsecurity

Fedora 43: freerdp Critical Heap Buffer Overflow Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • January 16, 2026

The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox. Update Information : Update to 3.20.2

The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP

xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows

machines, xrdp and VirtualBox.

* Wed Jan 14 2026 Ondrej Holy - 2:3.20.2-1 - Update to 3.20.2 * Wed Jan 14 2026 Ondrej Holy - 2:3.20.1-1 - Update to 3.20.1 Resolves: rhbz#2423151

[ 1 ] Bug #2429784 - CVE-2026-22857 freerdp: FreeRDP heap-use-after-free [fedora-43] [ 2 ] Bug #2429789 - CVE-2026-22859 freerdp: FreeRDP heap-buffer-overflow [fedora-43] [ 3 ] Bug #2429797 - CVE-2026-22852 freerdp: FreeRDP heap-buffer-overflow [fedora-43] [ 4 ] Bug #2429803 - CVE-2026-22854 freerdp: FreeRDP heap-buffer-overflow [fedora-43] [ 5 ] Bug #2429806 - CVE-2026-22855 freerdp: FreeRDP heap-buffer-overflow [fedora-43] [ 6 ] Bug #2429812 - CVE-2026-22853 freerdp: FreeRDP heap-buffer-overflow [fedora-43] [ 7 ] Bug #2429816 - CVE-2026-22858 freerdp: FreeRDP global-buffer-overflow [fedora-43] ... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-79f923d917' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow Vulnerability in FreeRDP Clients Fedora has issued advisories regarding critical buffer overflow vulnerabilities in the xfreerdp and wlfreerdp Remote Desktop Protocol clients from the FreeRDP project. Users connecting to RDP servers, including Microsoft Windows machines, are affected. An update to version 3.20.2 was released on January 14, 2026, to address these issues. 4 sources 38

Extracted Entities

CVEs (7)

CVE-2026-22852 CVE-2026-22853 CVE-2026-22854 CVE-2026-22855 CVE-2026-22857 CVE-2026-22858 CVE-2026-22859

Platforms (2)

VirtualBox Windows