FreeRDP 3.29.0 is not enough: update to 3.30.0 (CVE-2026-68579)

"Remote desktop" lets you operate a computer somewhere else from your own machine, and on Linux most of those tools are built on top of one piece of software: FreeRDP. One security flaw after another has been found in it, of the kind that lets someone eavesdrop on your session or hijack your connection. The version you should be installing right now is FreeRDP 3.30.0, released on July 16, 2026. Version 3.29.0, released on July 14, still leaves some of the flaws unfixed.

Here is the sequence of events. On July 14, version 3.29.0 fixed 22 advisories in one go. Two days later, 3.30.0 fixed three more. The three that came later are the more serious ones: the project describes 3.30.0 as addressing "a critical server-side issue" and strongly recommends updating. On August 2, one of those three was assigned the identifier CVE-2026-68579 (9.6 out of 10).

Update, August 2: 3.29.0 is not enough — you need 3.30.0

This article originally told readers to update to "3.29.0." That advice was insufficient, and we apologize for the error. Version 3.30.0 came out on July 16, two days after 3.29.0, and 3.29.0 still contains flaws that have not been fixed.

On August 2, two new CVE identifiers related to this were registered. They were issued by VulnCheck, a US company that handles vulnerability data. Note, however, that the holes themselves are not new discoveries. The project's advisories were published back on July 20, and the fixes are already out. What happened this time is that already-public flaws were given CVE numbers after the fact.

CVE-2026-68579: exploited through a paste (fixed in 3.30.0)

During a remote session, your own computer and the machine at the far end can share a clipboard. The problem occurs when you paste a file that lives on the remote machine onto your local computer. When FreeRDP copied the data arriving from the remote end into memory on your machine, it simply trusted the length the other side declared. Because it never checked that against the size of the destination buffer, a malicious remote machine only has to declare an oversized length for the data to spill out of the space that was set aside for it (GHSA-m37j-jcr2-8gcc).

It is like a warehouse pouring a delivery onto a shelf based on the "contents: 10 kg" written on the shipping label, without ever checking whether the box fits. What overflows lands on the neighboring shelf, which here means the memory used by the app that performed the paste (Windows File Explorer, for example). Under the right conditions, an attacker can write data of their choosing there.

That said, the scope is limited. The defective code is used only by FreeRDP's Windows client (wfreerdp). Because it depends on a Windows component (OLE), Linux-side apps such as Remmina, GNOME Connections, and KRDC are not affected by this particular item. It also does not trigger unless the user actually performs a paste.

CVE-2026-68580: a risk when you use a microphone (already fixed in 3.29.0)

The other item, CVE-2026-68580 (7.5), concerns the feature that sends audio from your local microphone to the remote machine during a session. FreeRDP accepted a value sent by the remote end — how many frames to send per batch — without validating it. Pass an extreme value and the resulting calculation overflows, so the amount of memory reserved comes out wrong (GHSA-69xf-pqrw-596x).

This one hits Linux directly. Of the four audio backends, ALSA — the standard one on Linux — is the worst affected, and analysis tools have confirmed writes past the end of the allocated buffer. The other three backends (BSD, Windows, Android) mostly just crash the app. The reporter is Ömer Can VURAL. Triggering it requires that you have microphone forwarding enabled on your side.

This item was already fixed in 3.29.0. If you have moved to 3.29.0, you are covered against this particular flaw.

The other two fixed in 3.30.0 may be the heavier ones

Only those two got CVE numbers, but 3.30.0 addresses two further advisories as well. GHSA-rqgv-grx4-xm6x, published on July 26, describes how a machine running FreeRDP as the "receiving" end of remote access can let someone through authentication with no password at all. The variable that records whether authentication succeeded held a value meaning "success" from the start, and requests that did not belong at that stage of authentication were accepted without checks. This appears to be what the project meant by "a critical server-side issue" in 3.30.0.

The other, GHSA-vv64-95pc-vj9v, is a missing length check in the handling of Kerberos, the authentication scheme used in corporate networks. This one affects both directions, the connecting side as well as the receiving side. Neither of these two has a CVE number yet. Without a number they are easy to miss, so take note.

Note: the "patched versions" field on the GHSA-rqgv-grx4-xm6x advisory page is still blank, yet the 3.30.0 release notes refer to it as addressed. That inconsistency had not been resolved as of August 2.

Found by an AI, and credited as such by the project

All three items fixed in 3.30.0 credit Anthropic's generative AI "Claude" alongside the security firm Ada Logics. They were reported through Anthropic's coordinated vulnerability disclosure program, with David Korczynski listed as the reporter. This is a case where having an AI read source code to hunt for weaknesses led to real fixes in software used all over the world.

So which version do you actually need?

Since the start of July, FreeRDP has been updated three times in quick succession: 3.28.0, 3.29.0, and 3.30.0. Here is what each step fixes.

The catch is that depending on which Linux you run, 3.30.0 may not have reached you yet. As of August 2, Fedora, Arch Linux, Homebrew, nixpkgs, and Debian's development branch all ship 3.30.0, but a cross-distribution package listing shows Alpine Linux — popular as a lightweight distribution — still stuck at 3.29.0 in both its stable and development branches. Debian's stable release (trixie) is still on the 3.15.0 series.

Also, as of August 2, neither CVE-2026-68579 nor CVE-2026-68580 was listed on the security tracking pages of Debian, Ubuntu, or Red Hat (the corresponding pages simply do not exist yet). That is not surprising on the very day the numbers were issued, but be aware that "not on my distributor's tracker" does not mean "safe." Checking the version on your own machine is the reliable approach.

To check, run something like xfreerdp3 /version or apt list --installed | grep freerdp in a terminal. If your distribution's package has not reached 3.30.0, your immediate options are to build the official 3.30.0 yourself, or to avoid connecting to servers you do not trust until the update arrives. And since of the two serious items the clipboard one only affects the Windows client and the microphone one only applies when microphone forwarding is on, turning those features off is a reasonable stopgap.

What FreeRDP is, and why your app may use it

FreeRDP is an open-source reimplementation of Microsoft's Remote Desktop Protocol (RDP) that anyone can use freely. It works as a standalone tool, but more importantly it is embedded as a building block (a library) inside many other apps.

The popular Linux remote-desktop app Remmina, GNOME's built-in "GNOME Connections," KDE's "KRDC," and in fact most Linux RDP clients all call FreeRDP under the hood. Many people are using it without ever knowing the name.

That is exactly what makes these flaws worrying. When a single shared component has a hole, every downstream app that bundles it is affected too. For more on how one component's flaw ripples across many products, see our explainer on open-source component supply-chain risk.

Note that the "Remote Desktop Connection" built into Windows (mstsc.exe) is a separate program made by Microsoft and is unrelated to FreeRDP. Windows' own remote desktop is not affected here. What is affected is software that uses FreeRDP, mostly apps on Linux, Mac, and mobile.

Who would exploit this, and why

The people put in a strong position by the critical flaws are attackers who can sit on the path of your traffic (on public Wi-Fi or a corporate network), or the owner of a server you connect to that has been taken over. Remote desktop is assumed to be "safe because it's encrypted," but the very mechanism that decides whether that encryption can be trusted was broken.

Such an attacker can impersonate a legitimate server, wedge into the connection, and read your screen and keystrokes that should be protected, or slip tampered data into the traffic. To the user's computer it looks like a normal, successful connection, which is what makes the interception hard to notice.

The first victim is the person doing the remote work. The IDs and passwords they type on the far end, and the contents of the screen they are working on, can be handed to a third party, who may then seize control of the session. For a company, an employee's remote connection becomes an entry point, giving attackers a foothold into internal systems. Workplaces where people connect to internal servers from home or while traveling face the biggest exposure.

The main fixed vulnerabilities

Below are the main CVE-numbered items among the 22 advisories in FreeRDP 3.29.0, ordered by severity. "Attack direction" shows whether a malicious server attacks the connecting client (the user side), or a malicious client attacks the server. Most target the user side.

Severity follows the CVSS v3.1 score (out of 10). The set also includes further certificate-validation flaws (CVE-2026-67293, CVE-2026-67294) and a partial information-leak flaw (CVE-2026-67292). For the full list, see the project's official announcement.

A closer look at the two most dangerous

CVE-2026-66402: slipping past the server's "identity check"

This is the most serious of the batch. Remote desktop traffic is protected by SSL/TLS encryption, and to confirm "is the machine I connected to the real server?" it checks a "TLS certificate," the electronic equivalent of an ID card. CVE-2026-66402 is a flaw in that identity-matching step.

Instead of using OpenSSL's safe, length-aware matching functions, FreeRDP compared the server name in the certificate with its own custom logic. As a result, a special character embedded mid-name can cut the check short, and a partial name match can cause the rest of a mismatch to be overlooked. An attacker can reuse a certificate issued for a different party and impersonate the legitimate server. The severity is rated 9.8 out of 10.

CVE-2026-67289: injecting rogue commands into the traffic

The other critical item, CVE-2026-67289, matters when connecting through a proxy (a server that relays traffic), as is common in corporate networks. The connection request FreeRDP sends to the relay can have control characters (line breaks) smuggled into it by an attacker.

Because the text of a request is delimited by those line breaks, inserting a fake delimiter lets an attacker split one request and slip in a separate command (a technique called HTTP response splitting). This can fool the relay server, leading to theft of connection details or hijacking of the traffic. This too is rated 9.8.

Some flaws trigger just by connecting to a bad server

Beyond the two critical items, there are many "High (7.5)" flaws. The notable point is that most of them trigger simply when a user connects to a malicious server. Video playback handling (CVE-2026-67290), on-screen glyph drawing (CVE-2026-67291), shape drawing (CVE-2026-67301), and smart-card authentication (CVE-2026-67288) all had bugs that read memory beyond its intended bounds, or reused already-freed memory.

By luring a user into connecting to a crafted server, these can crash the app or, under the right conditions, be used as a stepping stone to run malicious code. The basic rule "don't carelessly connect to unknown servers" matters more than ever here.

On the other hand, flaws like CVE-2026-67296 and CVE-2026-67298 let a malicious client attack a machine running FreeRDP as a server and knock the service offline. If you run the "receiving" side of remote access with FreeRDP, you also need to update.

Are you affected? What to do, by app

Everything from here down covers the 20-plus flaws fixed together in 3.29.0 on July 14. The version to move to is 3.30.0, as explained above, but every flaw in this part of the article was already fixed as of 3.29.0. Most people use FreeRDP indirectly through another app, so match your situation below.

On Linux, running your normal OS software update (Ubuntu's "Software Updater," or apt update && apt upgrade) swaps in the fixed FreeRDP build your distribution has prepared. Timing differs by distribution, so apply the update promptly when FreeRDP or Remmina appears in the update list. If you build from source, get it from the GitHub 3.30.0 release or the official download page.

Who reported it, and the exploitation status

The fixes are based on reports from several security researchers. According to the project, Bin Luo of UESTC reported 18 of the 22, with Team Atlanta, @canomer, @HEXER365, and Tencent's Yunding Security Lab also credited. FreeRDP lead developer Armin Novak (akallabeth) states in the release notes that "an update is highly recommended." Help Net Security and Linuxiac also covered the release.

As of August 2, 2026, there is no official report of these flaws being used in real-world attacks. We checked the latest edition of the US government's CISA "Known Exploited Vulnerabilities" catalog — the list of flaws confirmed to have been used in actual attacks (July 29 edition, 1,656 entries) — and it contains no FreeRDP items. That said, a flaw that slips past certificate checks is especially attractive for remote access over untrusted networks such as public Wi-Fi. Updating before exploitation spreads is the safe choice.

One correction worth noting: some technical outlets have reported the clipboard flaw as "affects 3.28.0 and earlier, fixed in 3.29.0" with a severity of CRITICAL. The project's own advisory, however, says "affects 3.29.0 and earlier, fixed in 3.30.0, severity HIGH." This article follows the project's wording. Since a single version number decides whether you still need to update, we recommend reading the advisory itself if you are unsure.

Bottom line

FreeRDP was updated three times in three weeks in July: 3.28.0, 3.29.0, and 3.30.0. Version 3.29.0 fixed 22 advisories in one batch, and 3.30.0 fixed three more two days later. The one to install is 3.30.0. If you stop at 3.29.0, you are left with the flaw that can be exploited through a paste (CVE-2026-68579) and the one that lets someone past the receiving side's authentication with no password.

If you use Remmina or GNOME Connections to work remotely on Linux, check your system's software updates first. In most cases a normal OS update swaps in the fixed build. Be aware, though, that some environments — Alpine Linux and Debian stable among them — had still not received 3.30.0 as of August 2. If you develop a product that bundles FreeRDP, you need to raise the bundled version to 3.30.0 or later.

What this episode shows is that the day a CVE number is assigned and the day you became exposed are two different things. CVE-2026-68579 got its number on August 2, but the project's advisory came out on July 20 and the fixed release shipped on July 16. Wait for the number before acting and you are two weeks late. Conversely, advisories that never get a number — exactly the case with the Kerberos and authentication-bypass items here — may never show up in your alerts at all. For the other software that had CVE numbers registered on that same day, see our roundup of the 11 identifiers assigned on August 2.

Sources

• ▸ FreeRDP - 3.30.0 release (official announcement) (July 16, 2026)
• ▸ GitHub - FreeRDP/FreeRDP Release 3.30.0
• ▸ GHSA-m37j-jcr2-8gcc - Windows clipboard heap overflow (CVE-2026-68579) (July 20, 2026)
• ▸ GHSA-69xf-pqrw-596x - audin integer overflow (CVE-2026-68580) (July 20, 2026)
• ▸ GHSA-rqgv-grx4-xm6x - RDSTLS server authentication bypass (July 26, 2026)
• ▸ GHSA-vv64-95pc-vj9v - Kerberos GSS Wrap-token unbounded EC field (July 26, 2026)
• ▸ NVD - CVE-2026-68579
• ▸ NVD - CVE-2026-68580
• ▸ FreeRDP - 3.29.0 release (official announcement) (July 13, 2026)
• ▸ GitHub - FreeRDP/FreeRDP Release 3.29.0
• ▸ Help Net Security - FreeRDP 3.29.0 security update resolves 22 advisories (July 15, 2026)
• ▸ Linuxiac - FreeRDP 3.29 Is Out With Extensive Security Fixes
• ▸ NVD - CVE-2026-66402
• ▸ NVD - CVE-2026-67289
• ▸ Remmina - the free Linux RDP client