ALAS2-2026-3238

Amazon Linux 2 Security Advisory: ALAS2-2026-3238
Advisory Released Date: 2026-04-14
Advisory Updated Date: 2026-04-14
Severity: Important
Issue Overview:

DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93 (CVE-2026-33952)

DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5 (CVE-2026-33977)

Progressive Codec Quant BYTE Underflow - UB + CPU DoS

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478 (CVE-2026-33983)

ClearCodec resize_vbar_entry() Heap OOB Write

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6 (CVE-2026-33984)

ClearCodec Glyph Cache Count Desync - Heap OOB Read

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85 (CVE-2026-33985)

H.264 YUV Buffer Dimension Desync - Heap OOB Write

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97 (CVE-2026-33986)


Affected Packages:

freerdp


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update freerdp or yum update --advisory ALAS2-2026-3238 to update your system.

New Packages:
aarch64:
    freerdp-2.11.7-1.amzn2.0.10.aarch64
    freerdp-libs-2.11.7-1.amzn2.0.10.aarch64
    freerdp-devel-2.11.7-1.amzn2.0.10.aarch64
    libwinpr-2.11.7-1.amzn2.0.10.aarch64
    libwinpr-devel-2.11.7-1.amzn2.0.10.aarch64
    freerdp-debuginfo-2.11.7-1.amzn2.0.10.aarch64

i686:
    freerdp-2.11.7-1.amzn2.0.10.i686
    freerdp-libs-2.11.7-1.amzn2.0.10.i686
    freerdp-devel-2.11.7-1.amzn2.0.10.i686
    libwinpr-2.11.7-1.amzn2.0.10.i686
    libwinpr-devel-2.11.7-1.amzn2.0.10.i686
    freerdp-debuginfo-2.11.7-1.amzn2.0.10.i686

src:
    freerdp-2.11.7-1.amzn2.0.10.src

x86_64:
    freerdp-2.11.7-1.amzn2.0.10.x86_64
    freerdp-libs-2.11.7-1.amzn2.0.10.x86_64
    freerdp-devel-2.11.7-1.amzn2.0.10.x86_64
    libwinpr-2.11.7-1.amzn2.0.10.x86_64
    libwinpr-devel-2.11.7-1.amzn2.0.10.x86_64
    freerdp-debuginfo-2.11.7-1.amzn2.0.10.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-33952, CVE-2026-33977, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985, CVE-2026-33986

Mitre: CVE-2026-33952, CVE-2026-33977, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985, CVE-2026-33986