Amazon Linux 2023 Security Advisory: ALAS2023-2026-3435
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
FAQs regarding Amazon Linux ALAS/CVE Severity
FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service. (CVE-2026-121951)
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation. (CVE-2026-121955)
FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process. (CVE-2026-121956)
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers. (CVE-2026-121957)
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS. (CVE-2026-121958)
FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process. (CVE-2026-121960)
FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service. (CVE-2026-121962)
FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution. (CVE-2026-121964)
Affected Packages:
freerdp
Issue Correction:
Run dnf update freerdp --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3435 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libwinpr-debuginfo-3.33.0-3.amzn2023.aarch64
freerdp-libs-debuginfo-3.33.0-3.amzn2023.aarch64
libwinpr-devel-3.33.0-3.amzn2023.aarch64
freerdp-server-debuginfo-3.33.0-3.amzn2023.aarch64
freerdp-3.33.0-3.amzn2023.aarch64
freerdp-debugsource-3.33.0-3.amzn2023.aarch64
libwinpr-3.33.0-3.amzn2023.aarch64
freerdp-debuginfo-3.33.0-3.amzn2023.aarch64
freerdp-devel-3.33.0-3.amzn2023.aarch64
freerdp-server-3.33.0-3.amzn2023.aarch64
freerdp-libs-3.33.0-3.amzn2023.aarch64
src:
freerdp-3.33.0-3.amzn2023.src
x86_64:
freerdp-libs-debuginfo-3.33.0-3.amzn2023.x86_64
freerdp-debuginfo-3.33.0-3.amzn2023.x86_64
freerdp-debugsource-3.33.0-3.amzn2023.x86_64
libwinpr-devel-3.33.0-3.amzn2023.x86_64
freerdp-server-debuginfo-3.33.0-3.amzn2023.x86_64
freerdp-server-3.33.0-3.amzn2023.x86_64
libwinpr-debuginfo-3.33.0-3.amzn2023.x86_64
libwinpr-3.33.0-3.amzn2023.x86_64
freerdp-3.33.0-3.amzn2023.x86_64
freerdp-devel-3.33.0-3.amzn2023.x86_64
freerdp-libs-3.33.0-3.amzn2023.x86_64