# ALAS2023-2026-3307: Security update for 11 packages

ALAS2023-2026-3307, released November 7, 2026, fixes 56 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3307
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-111378, high severity)
- CVEs: 56, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3307.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [freerdp](https://patchblox.com/security/data/product/linux/freerdp.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-debuginfo](https://patchblox.com/security/data/product/linux/freerdp-debuginfo.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-debugsource](https://patchblox.com/security/data/product/linux/freerdp-debugsource.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-devel](https://patchblox.com/security/data/product/linux/freerdp-devel.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-libs](https://patchblox.com/security/data/product/linux/freerdp-libs.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-libs-debuginfo](https://patchblox.com/security/data/product/linux/freerdp-libs-debuginfo.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-server](https://patchblox.com/security/data/product/linux/freerdp-server.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [freerdp-server-debuginfo](https://patchblox.com/security/data/product/linux/freerdp-server-debuginfo.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [libwinpr](https://patchblox.com/security/data/product/linux/libwinpr.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [libwinpr-debuginfo](https://patchblox.com/security/data/product/linux/libwinpr-debuginfo.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |
| [libwinpr-devel](https://patchblox.com/security/data/product/linux/libwinpr-devel.md) | amzn 2023 | 2:3.32.1-1.amzn2023.0.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-111378](https://patchblox.com/security/data/cve/CVE-2026-111378.md) | High | freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu th... | 8.8 | 0.0052 |  |
| [CVE-2026-109257](https://patchblox.com/security/data/cve/CVE-2026-109257.md) | High | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling pl... | 7.5 | 0.0039 |  |
| [CVE-2026-111382](https://patchblox.com/security/data/cve/CVE-2026-111382.md) | High | freerdp3: FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and gener... | 8.8 | 0.0038 |  |
| [CVE-2026-110837](https://patchblox.com/security/data/cve/CVE-2026-110837.md) | High | freerdp3: FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow i... | 8.8 | 0.0037 |  |
| [CVE-2026-110838](https://patchblox.com/security/data/cve/CVE-2026-110838.md) | High | freerdp3: FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentic... | 8.8 | 0.0033 |  |
| [CVE-2026-111880](https://patchblox.com/security/data/cve/CVE-2026-111880.md) | High | freerdp3: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path th... | 8.8 | 0.0032 |  |
| [CVE-2026-110830](https://patchblox.com/security/data/cve/CVE-2026-110830.md) | High | freerdp3-shadow-x11: FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP serv... | 8.8 | 0.0032 |  |
| [CVE-2026-110833](https://patchblox.com/security/data/cve/CVE-2026-110833.md) | High | freerdp3: FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR ch... | 8.8 | 0.0032 |  |
| [CVE-2026-109242](https://patchblox.com/security/data/cve/CVE-2026-109242.md) | High | freerdp3-shadow-x11: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles beca... | 8.8 | 0.0030 |  |
| [CVE-2026-111373](https://patchblox.com/security/data/cve/CVE-2026-111373.md) | High | freerdp3: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a mali... | 7.5 | 0.0028 |  |
| [CVE-2026-110839](https://patchblox.com/security/data/cve/CVE-2026-110839.md) | High | libwinpr-tools3-3: FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr... | 8.8 | 0.0027 |  |
| [CVE-2026-109676](https://patchblox.com/security/data/cve/CVE-2026-109676.md) | High | freerdp3-shadow-x11: FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows atta... | 8.8 | 0.0026 |  |
| [CVE-2026-111379](https://patchblox.com/security/data/cve/CVE-2026-111379.md) | High | freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows loc... | 8.8 | 0.0019 |  |
| [CVE-2026-111381](https://patchblox.com/security/data/cve/CVE-2026-111381.md) | High | freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows loc... | 8.8 | 0.0018 |  |
| [CVE-2026-109949](https://patchblox.com/security/data/cve/CVE-2026-109949.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smar... | n/a | 0.0041 |  |
| [CVE-2026-109246](https://patchblox.com/security/data/cve/CVE-2026-109246.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id i... | n/a | 0.0040 |  |
| [CVE-2026-109951](https://patchblox.com/security/data/cve/CVE-2026-109951.md) | Routine | freerdp3: FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the fr... | n/a | 0.0037 |  |
| [CVE-2026-109677](https://patchblox.com/security/data/cve/CVE-2026-109677.md) | Routine | freerdp3-shadow-x11: FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Ca... | n/a | 0.0035 |  |
| [CVE-2026-109678](https://patchblox.com/security/data/cve/CVE-2026-109678.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reac... | 6.5 | 0.0033 |  |
| [CVE-2026-109939](https://patchblox.com/security/data/cve/CVE-2026-109939.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp... | n/a | 0.0033 |  |
| [CVE-2026-109941](https://patchblox.com/security/data/cve/CVE-2026-109941.md) | Routine | freerdp3: FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious... | n/a | 0.0033 |  |
| [CVE-2026-109946](https://patchblox.com/security/data/cve/CVE-2026-109946.md) | Routine | freerdp3: FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversi... | n/a | 0.0033 |  |
| [CVE-2026-109947](https://patchblox.com/security/data/cve/CVE-2026-109947.md) | Routine | freerdp3: FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RD... | n/a | 0.0033 |  |
| [CVE-2026-109942](https://patchblox.com/security/data/cve/CVE-2026-109942.md) | Routine | freerdp3: FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c b... | n/a | 0.0033 |  |
| [CVE-2026-109952](https://patchblox.com/security/data/cve/CVE-2026-109952.md) | Routine | freerdp3-shadow-x11: The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against... | 5.3 | 0.0032 |  |
| [CVE-2026-109248](https://patchblox.com/security/data/cve/CVE-2026-109248.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptor... | n/a | 0.0032 |  |
| [CVE-2026-111377](https://patchblox.com/security/data/cve/CVE-2026-111377.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails t... | n/a | 0.0032 |  |
| [CVE-2026-110832](https://patchblox.com/security/data/cve/CVE-2026-110832.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allow... | n/a | 0.0031 |  |
| [CVE-2026-109256](https://patchblox.com/security/data/cve/CVE-2026-109256.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past t... | 6.5 | 0.0031 |  |
| [CVE-2026-110829](https://patchblox.com/security/data/cve/CVE-2026-110829.md) | Routine | winpr3-utils: FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment se... | n/a | 0.0031 |  |
| [CVE-2026-110834](https://patchblox.com/security/data/cve/CVE-2026-110834.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers... | n/a | 0.0031 |  |
| [CVE-2026-110836](https://patchblox.com/security/data/cve/CVE-2026-110836.md) | Routine | freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows maliciou... | n/a | 0.0031 |  |
| [CVE-2026-109680](https://patchblox.com/security/data/cve/CVE-2026-109680.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks th... | 6.5 | 0.0030 |  |
| [CVE-2026-109679](https://patchblox.com/security/data/cve/CVE-2026-109679.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint r... | 5.3 | 0.0030 |  |
| [CVE-2026-111374](https://patchblox.com/security/data/cve/CVE-2026-111374.md) | Routine | freerdp3-wayland: FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malici... | n/a | 0.0030 |  |
| [CVE-2026-109247](https://patchblox.com/security/data/cve/CVE-2026-109247.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libw... | n/a | 0.0029 |  |
| [CVE-2026-109252](https://patchblox.com/security/data/cve/CVE-2026-109252.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allo... | n/a | 0.0029 |  |
| [CVE-2026-109253](https://patchblox.com/security/data/cve/CVE-2026-109253.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which... | n/a | 0.0029 |  |
| [CVE-2026-109948](https://patchblox.com/security/data/cve/CVE-2026-109948.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call... | n/a | 0.0029 |  |
| [CVE-2026-109943](https://patchblox.com/security/data/cve/CVE-2026-109943.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies... | n/a | 0.0029 |  |
| [CVE-2026-109944](https://patchblox.com/security/data/cve/CVE-2026-109944.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulat... | n/a | 0.0029 |  |
| [CVE-2026-109950](https://patchblox.com/security/data/cve/CVE-2026-109950.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway... | 4.3 | 0.0028 |  |
| [CVE-2026-110831](https://patchblox.com/security/data/cve/CVE-2026-110831.md) | Routine | freerdp3: FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers... | n/a | 0.0028 |  |
| [CVE-2026-109953](https://patchblox.com/security/data/cve/CVE-2026-109953.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admi... | n/a | 0.0027 |  |
| [CVE-2026-109240](https://patchblox.com/security/data/cve/CVE-2026-109240.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious... | n/a | 0.0026 |  |
| [CVE-2026-110835](https://patchblox.com/security/data/cve/CVE-2026-110835.md) | Routine | freerdp3: FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a ro... | 5.8 | 0.0026 |  |
| [CVE-2026-109250](https://patchblox.com/security/data/cve/CVE-2026-109250.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attacke... | n/a | 0.0026 |  |
| [CVE-2026-109254](https://patchblox.com/security/data/cve/CVE-2026-109254.md) | Routine | freerdp3-shadow-x11: FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, whi... | n/a | 0.0025 |  |
| [CVE-2026-111881](https://patchblox.com/security/data/cve/CVE-2026-111881.md) | Routine | freerdp3: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride ca... | n/a | 0.0025 |  |
| [CVE-2026-109945](https://patchblox.com/security/data/cve/CVE-2026-109945.md) | Routine | freerdp3: FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISC... | 5.9 | 0.0024 |  |
| [CVE-2026-109245](https://patchblox.com/security/data/cve/CVE-2026-109245.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in li... | n/a | 0.0023 |  |
| [CVE-2026-109241](https://patchblox.com/security/data/cve/CVE-2026-109241.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that... | n/a | 0.0022 |  |
| [CVE-2026-109249](https://patchblox.com/security/data/cve/CVE-2026-109249.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because... | n/a | 0.0017 |  |
| [CVE-2026-109244](https://patchblox.com/security/data/cve/CVE-2026-109244.md) | Routine | freerdp3-shadow-x11: FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencry... | n/a | 0.0014 |  |
| [CVE-2026-109940](https://patchblox.com/security/data/cve/CVE-2026-109940.md) | Routine | freerdp3: FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyN... | 4.6 | 0.0014 |  |
| [CVE-2026-109243](https://patchblox.com/security/data/cve/CVE-2026-109243.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to... | n/a | 0.0013 |  |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.