# freerdp-proxy 3.32.0+dfsg-0ubuntu0.26.04.1: freerdp-proxy 3.32.0+dfsg-0ubuntu0.26.04.1 for Ubuntu 26.04.1 LTS (resolute)

freerdp-proxy 3.32.0+dfsg-0ubuntu0.26.04.1, released November 7, 2026, fixes 62 CVEs in freerdp-proxy. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-resolute-freerdp-proxy-3.32.0-dfsg-0ubuntu0.26.04.1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-111375, rated Critical)
- CVEs: 62, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [freerdp-proxy](https://patchblox.com/security/data/product/linux/freerdp-proxy.md) | Ubuntu 26.04.1 LTS (resolute) | 3.32.0+dfsg-0ubuntu0.26.04.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-111375](https://patchblox.com/security/data/cve/CVE-2026-111375.md) | Urgent | freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows... | 9.1 | 0.0032 |  |
| [CVE-2026-111378](https://patchblox.com/security/data/cve/CVE-2026-111378.md) | High | freerdp: ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT) | 8.8 | 0.0052 |  |
| [CVE-2026-109257](https://patchblox.com/security/data/cve/CVE-2026-109257.md) | High | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling pl... | 7.5 | 0.0039 |  |
| [CVE-2026-111382](https://patchblox.com/security/data/cve/CVE-2026-111382.md) | High | freerdp3: FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and gener... | 8.8 | 0.0038 |  |
| [CVE-2026-110837](https://patchblox.com/security/data/cve/CVE-2026-110837.md) | High | freerdp: Backport several CVE fixes (CVE-2026-109242 | 8.8 | 0.0037 |  |
| [CVE-2026-110838](https://patchblox.com/security/data/cve/CVE-2026-110838.md) | High | freerdp: ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT) | 8.8 | 0.0033 |  |
| [CVE-2026-111880](https://patchblox.com/security/data/cve/CVE-2026-111880.md) | High | freerdp: Resolves: RHEL-282289, RHEL-283715, RHEL-286595 | 8.8 | 0.0032 |  |
| [CVE-2026-110830](https://patchblox.com/security/data/cve/CVE-2026-110830.md) | High | freerdp3-shadow-x11: FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP serv... | 8.8 | 0.0032 |  |
| [CVE-2026-110833](https://patchblox.com/security/data/cve/CVE-2026-110833.md) | High | freerdp: ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT) | 8.8 | 0.0032 |  |
| [CVE-2026-109242](https://patchblox.com/security/data/cve/CVE-2026-109242.md) | High | freerdp3-shadow-x11: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles beca... | 8.8 | 0.0030 |  |
| [CVE-2026-111373](https://patchblox.com/security/data/cve/CVE-2026-111373.md) | High | freerdp3: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a mali... | 7.5 | 0.0028 |  |
| [CVE-2026-110839](https://patchblox.com/security/data/cve/CVE-2026-110839.md) | High | libwinpr-tools3-3: FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr... | 8.8 | 0.0027 |  |
| [CVE-2026-109676](https://patchblox.com/security/data/cve/CVE-2026-109676.md) | High | freerdp3-shadow-x11: FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows atta... | 8.8 | 0.0026 |  |
| [CVE-2026-111379](https://patchblox.com/security/data/cve/CVE-2026-111379.md) | High | freerdp: ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT) | 8.8 | 0.0019 |  |
| [CVE-2026-111381](https://patchblox.com/security/data/cve/CVE-2026-111381.md) | High | freerdp: ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT) | 8.8 | 0.0018 |  |
| [CVE-2026-109255](https://patchblox.com/security/data/cve/CVE-2026-109255.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a... | n/a | 0.0050 |  |
| [CVE-2026-109949](https://patchblox.com/security/data/cve/CVE-2026-109949.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smar... | n/a | 0.0041 |  |
| [CVE-2026-109246](https://patchblox.com/security/data/cve/CVE-2026-109246.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id i... | n/a | 0.0040 |  |
| [CVE-2026-109951](https://patchblox.com/security/data/cve/CVE-2026-109951.md) | Routine | freerdp3: FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the fr... | n/a | 0.0037 |  |
| [CVE-2026-114046](https://patchblox.com/security/data/cve/CVE-2026-114046.md) | Routine | freerdp3: FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a nul... | n/a | 0.0035 |  |
| [CVE-2026-109678](https://patchblox.com/security/data/cve/CVE-2026-109678.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reac... | 6.5 | 0.0033 |  |
| [CVE-2026-109938](https://patchblox.com/security/data/cve/CVE-2026-109938.md) | Routine | freerdp3-shadow-x11: Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can termin... | n/a | 0.0033 |  |
| [CVE-2026-109939](https://patchblox.com/security/data/cve/CVE-2026-109939.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp... | n/a | 0.0033 |  |
| [CVE-2026-109941](https://patchblox.com/security/data/cve/CVE-2026-109941.md) | Routine | freerdp3: FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious... | n/a | 0.0033 |  |
| [CVE-2026-109946](https://patchblox.com/security/data/cve/CVE-2026-109946.md) | Routine | freerdp3: FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversi... | n/a | 0.0033 |  |
| [CVE-2026-109947](https://patchblox.com/security/data/cve/CVE-2026-109947.md) | Routine | freerdp3: FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RD... | n/a | 0.0033 |  |
| [CVE-2026-109942](https://patchblox.com/security/data/cve/CVE-2026-109942.md) | Routine | freerdp3: FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c b... | n/a | 0.0033 |  |
| [CVE-2026-109952](https://patchblox.com/security/data/cve/CVE-2026-109952.md) | Routine | freerdp3-shadow-x11: The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against... | 5.3 | 0.0032 |  |
| [CVE-2026-111380](https://patchblox.com/security/data/cve/CVE-2026-111380.md) | Routine | freerdp3: FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m)... | n/a | 0.0032 |  |
| [CVE-2026-109248](https://patchblox.com/security/data/cve/CVE-2026-109248.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptor... | n/a | 0.0032 |  |
| [CVE-2026-111377](https://patchblox.com/security/data/cve/CVE-2026-111377.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails t... | n/a | 0.0032 |  |
| [CVE-2026-110832](https://patchblox.com/security/data/cve/CVE-2026-110832.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allow... | n/a | 0.0031 |  |
| [CVE-2026-109256](https://patchblox.com/security/data/cve/CVE-2026-109256.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past t... | 6.5 | 0.0031 |  |
| [CVE-2026-110829](https://patchblox.com/security/data/cve/CVE-2026-110829.md) | Routine | winpr3-utils: FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment se... | n/a | 0.0031 |  |
| [CVE-2026-110834](https://patchblox.com/security/data/cve/CVE-2026-110834.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers... | n/a | 0.0031 |  |
| [CVE-2026-110836](https://patchblox.com/security/data/cve/CVE-2026-110836.md) | Routine | freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows maliciou... | n/a | 0.0031 |  |
| [CVE-2026-109680](https://patchblox.com/security/data/cve/CVE-2026-109680.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks th... | 6.5 | 0.0030 |  |
| [CVE-2026-109679](https://patchblox.com/security/data/cve/CVE-2026-109679.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint r... | 5.3 | 0.0030 |  |
| [CVE-2026-111374](https://patchblox.com/security/data/cve/CVE-2026-111374.md) | Routine | freerdp3-wayland: FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malici... | n/a | 0.0030 |  |
| [CVE-2026-109247](https://patchblox.com/security/data/cve/CVE-2026-109247.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libw... | n/a | 0.0029 |  |
| [CVE-2026-109251](https://patchblox.com/security/data/cve/CVE-2026-109251.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surf... | n/a | 0.0029 |  |
| [CVE-2026-109252](https://patchblox.com/security/data/cve/CVE-2026-109252.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allo... | n/a | 0.0029 |  |
| [CVE-2026-109253](https://patchblox.com/security/data/cve/CVE-2026-109253.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which... | n/a | 0.0029 |  |
| [CVE-2026-109948](https://patchblox.com/security/data/cve/CVE-2026-109948.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call... | n/a | 0.0029 |  |
| [CVE-2026-109943](https://patchblox.com/security/data/cve/CVE-2026-109943.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies... | n/a | 0.0029 |  |
| [CVE-2026-109944](https://patchblox.com/security/data/cve/CVE-2026-109944.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulat... | n/a | 0.0029 |  |
| [CVE-2026-109950](https://patchblox.com/security/data/cve/CVE-2026-109950.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway... | 4.3 | 0.0028 |  |
| [CVE-2026-110831](https://patchblox.com/security/data/cve/CVE-2026-110831.md) | Routine | freerdp3: FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers... | n/a | 0.0028 |  |
| [CVE-2026-109953](https://patchblox.com/security/data/cve/CVE-2026-109953.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admi... | n/a | 0.0027 |  |
| [CVE-2026-110835](https://patchblox.com/security/data/cve/CVE-2026-110835.md) | Routine | freerdp3: FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a ro... | 5.8 | 0.0026 |  |
| [CVE-2026-109250](https://patchblox.com/security/data/cve/CVE-2026-109250.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attacke... | n/a | 0.0026 |  |
| [CVE-2026-109254](https://patchblox.com/security/data/cve/CVE-2026-109254.md) | Routine | freerdp3-shadow-x11: FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, whi... | n/a | 0.0025 |  |
| [CVE-2026-111881](https://patchblox.com/security/data/cve/CVE-2026-111881.md) | Routine | freerdp3: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride ca... | n/a | 0.0025 |  |
| [CVE-2026-109945](https://patchblox.com/security/data/cve/CVE-2026-109945.md) | Routine | freerdp3: FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISC... | 5.9 | 0.0024 |  |
| [CVE-2026-109245](https://patchblox.com/security/data/cve/CVE-2026-109245.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in li... | n/a | 0.0023 |  |
| [CVE-2026-109241](https://patchblox.com/security/data/cve/CVE-2026-109241.md) | Routine | freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that... | n/a | 0.0022 |  |
| [CVE-2026-114047](https://patchblox.com/security/data/cve/CVE-2026-114047.md) | Routine | freerdp3: FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts... | n/a | 0.0019 |  |
| [CVE-2026-109249](https://patchblox.com/security/data/cve/CVE-2026-109249.md) | Routine | freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because... | n/a | 0.0017 |  |
| [CVE-2026-111376](https://patchblox.com/security/data/cve/CVE-2026-111376.md) | Routine | freerdp3: FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStr... | n/a | 0.0017 |  |
| [CVE-2026-109244](https://patchblox.com/security/data/cve/CVE-2026-109244.md) | Routine | freerdp3-shadow-x11: FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencry... | n/a | 0.0014 |  |
| [CVE-2026-109940](https://patchblox.com/security/data/cve/CVE-2026-109940.md) | Routine | freerdp3: FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyN... | 4.6 | 0.0014 |  |
| [CVE-2026-109243](https://patchblox.com/security/data/cve/CVE-2026-109243.md) | Routine | freerdp3-shadow-x11: FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to... | n/a | 0.0013 |  |

---

Data as of 2026-11-13T08:00:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.