FreeRDP released version 3.31.0, addressing 22 security flaws and multiple bugs in its open-source Remote Desktop Protocol implementation, and urges users and distributors to update promptly.
FreeRDP is widely used by Linux systems, thin clients, remote-access tools, and enterprise applications to connect to Windows Remote Desktop Services.
Because it processes network data from remote servers and supports features such as graphics, smart cards, USB redirection, clipboard sharing, and authentication, memory-handling mistakes can create serious security exposure.
The 3.31.0 release includes fixes for 22 GitHub Security Advisories, covering issues reported through the project’s security process. The advisory identifiers include GHSA-c5gr-hmqp-pwj4, GHSA-h5w2-q35j-443h, GHSA-m85m-3qxv-63h5, and 19 others.
While the release notes do not provide public technical details for every flaw, the vendor’s “update ASAP” warning shows that maintainers consider the addressed issues significant.
FreeRDP Fixes 22 Security Flaws
Several changes in the release point to security-sensitive code paths. FreeRDP fixed bounds checking in the AVC444v2 YUV decoder, which processes remote desktop graphics data.
It also corrected parsing and length-validation problems in dynamic virtual channels, Remote Desktop Gateway tunnel responses, clipboard format lists, smart-card data, USB redirection, and device-redirection components.
The update further resolves use-after-free conditions involving the printer driver singleton and the reallocation of aligned memory. Use-after-free bugs occur when software continues to access memory after it has been released.
Depending on the affected code path and surrounding protections, such flaws can lead to application crashes, information disclosure, or possibly remote code execution. Authentication and cryptographic components also received attention.
The release improves NTLM and SSPI memory handling, adds checks before accessing signature buffers, fixes SPNEGO mechanism fallback behavior, and improves error handling when BIO or SSL object creation fails.
These changes are important because FreeRDP often handles authentication exchanges and encrypted connections to remote systems.
In addition to security fixes, version 3.31.0 brings performance improvements. The project said an optimized YUV decoder should deliver faster client-side graphics for AVC and H.264 remote desktop sessions. It also adds support for more hardware decoders and switches AV1 decoding to dav1d in supported configurations.
Administrators should identify systems that package or embed FreeRDP, including desktop clients, remote-access gateways, virtual desktop tools, and third-party products built on the library.
Organizations should install FreeRDP 3.31.0 through their supported distribution channel or build the updated release from the official source package. Teams should also verify the downloaded archive using the published SHA-256 checksum and signature where possible.
Prompt patching is especially important for systems that connect to untrusted or internet-exposed RDP servers. The official release includes source archives, ZIP packages, signatures, and checksums for version 3.31.0.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post FreeRDP Fixes 22 Security Flaws and Urges Users to Update Immediately appeared first on Cyber Security News.