ALAS2023-2026-1379

References: CVE-2026-23530  CVE-2026-23531  CVE-2026-23532  CVE-2026-23533  CVE-2026-23534  CVE-2026-23883  CVE-2026-23884 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23530)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23531)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client's `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23532)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23533)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23534)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23883)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. (CVE-2026-23884)

Issue Correction:
Run dnf update freerdp --releasever 2023.10.20260202 or dnf update --advisory ALAS2023-2026-1379 --releasever 2023.10.20260202 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-server-debuginfo-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-server-3.6.3-1.amzn2023.0.2.aarch64
    libwinpr-devel-3.6.3-1.amzn2023.0.2.aarch64
    libwinpr-debuginfo-3.6.3-1.amzn2023.0.2.aarch64
    libwinpr-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-debuginfo-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-libs-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-devel-3.6.3-1.amzn2023.0.2.aarch64
    freerdp-debugsource-3.6.3-1.amzn2023.0.2.aarch64

src:
    freerdp-3.6.3-1.amzn2023.0.2.src

x86_64:
    freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-server-debuginfo-3.6.3-1.amzn2023.0.2.x86_64
    libwinpr-devel-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-debuginfo-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-server-3.6.3-1.amzn2023.0.2.x86_64
    libwinpr-debuginfo-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-devel-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-libs-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-3.6.3-1.amzn2023.0.2.x86_64
    libwinpr-3.6.3-1.amzn2023.0.2.x86_64
    freerdp-debugsource-3.6.3-1.amzn2023.0.2.x86_64