ALAS2027-2026-303

Fix GHSA-66mr-7wc7-23vc: FreeRDP client can abort while logging a malformed RDPDR device announcement

Fix GHSA-fqw6-jf2h-6fj6: RDPGFX ALPHA `WIRETOSURFACE_2` command can abort a FreeRDP client

Fix GHSA-x7w3-32ch-x2jq: winpr image conversion: heap over-read encoding 16 bpp DIBs to PNG; malformed PNG/JPEG abort or exit the process

Fix GHSA-m7xq-5f7v-hjvw: FreeRDP proxy has no cumulative limit for intercepted DVC message reassembly

Fix GHSA-2557-79qc-6gfr: FreeRDP WinPR Kerberos SSPI retrieveSomeTgt double free of the default realm

Fix GHSA-8rjm-m7xg-mg6m: RD Gateway extended-auth packet crashes FreeRDP client before tunnel authentication

Fix GHSA-jqf4-4p68-4p43: Opted-in GLYPH_INDEX client abort from unrepresentable background width

Fix GHSA-r387-jjq3-87hv: Serial RDPDR device-control output length can exhaust FreeRDP client memory

Fix GHSA-cx9c-q4jc-wm6c: Dynamic rdpsnd channel close leaves playback thread using a freed callback

Fix GHSA-983v-jp34-f3fm: FreeRDP smartcard emulation: use-after-free in ReleaseContext racing in-flight GetStatusChange

Fix GHSA-8g9g-hqqp-fw69: FreeRDP client leaks file descriptors on repeated parallel-device CREATE requests, allowing a hostile RDP server to exhaust the client process

Fix GHSA-f53w-3364-jr35: FreeRDP RDPGFX CREATE_SURFACE integer wrap causes a 32-bit heap overwrite

Fix GHSA-m59q-wm7v-mp57: FreeRDP RDPGFX client: heap out-of-bounds write in HashTable_GetKeys via surface-key truncation

Fix GHSA-x8vp-ff7m-294g: Authenticated remdesk channel payload aborts FreeRDP shadow server through stream-capacity assertion

Fix GHSA-wg7g-gx9g-r96c: FreeRDP truncated GSM610/WAV49 audio causes an out-of-bounds read

Fix GHSA-799q-hjgw-g55g: WinPR image readers abort/exit the client process on malformed PNG/JPEG (missing library error handling)

Fix GHSA-x26g-fp9v-c2pg: FreeRDP WebSocket client spins indefinitely when TLS closes during a frame payload

Fix GHSA-j536-qc58-pmf8: Partial Early User Authorization reads can overflow a FreeRDP client receive buffer

Fix GHSA-6wqx-rv3q-vcxp: FreeRDP client use-after-free in the rdpgfx dynamic virtual channel on channel close

Fix GHSA-fqcj-rwww-2498: Zero-length dynamic-channel DATA messages can spin FreeRDP shadow-server threads

Fix GHSA-q82v-5wjg-6h57: FreeRDP RD Gateway RPC client heap buffer overflow in rpc_client_recv_fragment

Fix GHSA-5qqp-5ffm-m3p9: Malformed drive request silently stops FreeRDP's drive worker and leaves later requests queued

Fix GHSA-qw7w-hhxq-763c: FreeRDP proxy DRDYNVC tracker race causes use-after-free and process crash

Fix GHSA-4vh4-3pc3-32p7: RD Gateway packet length causes 2 GiB client allocation before tunnel authentication

Fix GHSA-xc85-4mqc-xgcx: FreeRDP proxy out-of-bounds write in bitmap cache v2 capability handling

Fix GHSA-w897-ffhv-5j7g: USB redirection control-channel close can race a channel write in FreeRDP

Fix GHSA-x4x6-2hrm-hvq9: RD Gateway control packet can make FreeRDP client spin at full CPU

Fix GHSA-v85m-wg84-5ffh: FreeRDP URBDRC frees active libusb transfers during teardown

Fix GHSA-fg78-v8j5-8697: FreeRDP planar codec: non-atomic geometry and buffer update on failed ResetGraphics causes heap out-of-bounds write

Fix GHSA-jq25-3374-4262: Incomplete fix for GHSA-43hh-p3vw-hfx3: CN-fallback and IP-literal cert identity checks were never patched

Fix GHSA-rrp5-666j-g6gp: FreeRDP DRDYNVC DATA_FIRST length causes an uncapped client allocation

Fix GHSA-c426-ppvf-jpfg: Zero-width RDPGFX ResetGraphics causes a later FreeRDP X11 client crash

Fix GHSA-xjhw-2r55-m95g: FreeRDP planar bitmap decode: RDPGFX ResetGraphics race causes use-after-free of shared planar buffers

Fix GHSA-v3q2-qjvf-7rqw: FreeRDP proxy dyn-channel-dump session teardown causes cross-thread use-after-free

aarch64:
    freerdp-server-3.32.2-1.amzn2027.aarch64
    freerdp-debugsource-3.32.2-1.amzn2027.aarch64
    freerdp-libs-debuginfo-3.32.2-1.amzn2027.aarch64
    libwinpr-debuginfo-3.32.2-1.amzn2027.aarch64
    freerdp-server-debuginfo-3.32.2-1.amzn2027.aarch64
    libwinpr-devel-3.32.2-1.amzn2027.aarch64
    freerdp-devel-3.32.2-1.amzn2027.aarch64
    libwinpr-3.32.2-1.amzn2027.aarch64
    freerdp-debuginfo-3.32.2-1.amzn2027.aarch64
    freerdp-3.32.2-1.amzn2027.aarch64
    freerdp-libs-3.32.2-1.amzn2027.aarch64

src:
    freerdp-3.32.2-1.amzn2027.src

x86_64:
    libwinpr-debuginfo-3.32.2-1.amzn2027.x86_64
    libwinpr-devel-3.32.2-1.amzn2027.x86_64
    libwinpr-3.32.2-1.amzn2027.x86_64
    freerdp-server-debuginfo-3.32.2-1.amzn2027.x86_64
    freerdp-debuginfo-3.32.2-1.amzn2027.x86_64
    freerdp-libs-3.32.2-1.amzn2027.x86_64
    freerdp-debugsource-3.32.2-1.amzn2027.x86_64
    freerdp-devel-3.32.2-1.amzn2027.x86_64
    freerdp-3.32.2-1.amzn2027.x86_64
    freerdp-server-3.32.2-1.amzn2027.x86_64
    freerdp-libs-debuginfo-3.32.2-1.amzn2027.x86_64