FreeRDP bug can run code

Published September 11, 2026

FreeRDP has a CERT-Bund advisory for 6 vulnerabilities in versions before 3.27.0. An attacker can exploit multiple vulnerabilities in FreeRDP to cause unspecified impacts, potentially execute arbitrary code, bypass security measures, manipulate data, disclose sensitive information, or trigger a denial-of-service condition.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 3.27.0Fix recorded 2 days ago
Affected versions
before 3.27.0
Affects
FreeRDP+3 more
Exploited
Not confirmedNo confirmation recorded

How it works

An attacker can exploit multiple vulnerabilities in FreeRDP to cause unspecified impacts, potentially execute arbitrary code, bypass security measures, manipulate data, disclose sensitive information, or trigger a denial-of-service condition.

What to do

Check your FreeRDP version. If it is before 3.27.0, this advisory applies.

Update FreeRDP to 3.27.0 or newer.

Technical details

Affected software: FreeRDP, Sonstiges, UNIX, Windows

CERT-Bund describes FreeRDP as a freie Implementierung des Remote Desktop Protocol (RDP). An attacker can exploit multiple vulnerabilities in FreeRDP to cause unspecified impacts, potentially execute arbitrary code, bypass security measures, manipulate data, disclose sensitive information, or trigger a denial-of-service condition. The advisory tracks CVE-2026-55191, CVE-2026-55192, CVE-2026-55193, CVE-2026-55194, CVE-2026-55564, CVE-2026-55648.

In CERT-Bund's CSAF data, affected versions are before 3.27.0, and the fixed version is 3.27.0. Affected operating systems listed by CERT-Bund: Sonstiges, UNIX, Windows.

References

View Original Source