Linux · Amazon Linux · Security advisory · November 7, 2026

ALAS2023-2026-3307: Security update for 11 packages

ALAS2023-2026-3307, released November 7, 2026, fixes 56 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
56
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0052
44th percentile

Priority of the 56 CVEs

Patch now 0 Urgent 0 High 14 Routine 42

Fixed package versions

ProductReleaseFixed in
freerdpamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-debuginfoamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-debugsourceamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-develamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-libsamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-libs-debuginfoamzn 20232:3.32.1-1.amzn2023.0.1
freerdp-serveramzn 20232:3.32.1-1.amzn2023.0.1
freerdp-server-debuginfoamzn 20232:3.32.1-1.amzn2023.0.1
libwinpramzn 20232:3.32.1-1.amzn2023.0.1
libwinpr-debuginfoamzn 20232:3.32.1-1.amzn2023.0.1
libwinpr-develamzn 20232:3.32.1-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-111378 freerdp3: FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu th...8.8 0.0052 None reported
High CVE-2026-109257 freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling pl...7.5 0.0039 None reported
High CVE-2026-111382 freerdp3: FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and gener...8.8 0.0038 None reported
High CVE-2026-110837 freerdp3: FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow i...8.8 0.0037 None reported
High CVE-2026-110838 freerdp3: FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentic...8.8 0.0033 None reported
High CVE-2026-111880 freerdp3: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path th...8.8 0.0032 None reported
High CVE-2026-110830 freerdp3-shadow-x11: FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP serv...8.8 0.0032 None reported
High CVE-2026-110833 freerdp3: FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR ch...8.8 0.0032 None reported
High CVE-2026-109242 freerdp3-shadow-x11: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles beca...8.8 0.0030 None reported
High CVE-2026-111373 freerdp3: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a mali...7.5 0.0028 None reported
High CVE-2026-110839 libwinpr-tools3-3: FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr...8.8 0.0027 None reported
High CVE-2026-109676 freerdp3-shadow-x11: FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows atta...8.8 0.0026 None reported
High CVE-2026-111379 freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows loc...8.8 0.0019 None reported
High CVE-2026-111381 freerdp3: FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows loc...8.8 0.0018 None reported
Routine CVE-2026-109949 freerdp3-shadow-x11: FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smar...n/a 0.0041 None reported
Routine CVE-2026-109246 freerdp3-shadow-x11: FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id i...n/a 0.0040 None reported
Routine CVE-2026-109951 freerdp3: FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the fr...n/a 0.0037 None reported
Routine CVE-2026-109677 freerdp3-shadow-x11: FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Ca...n/a 0.0035 None reported
Routine CVE-2026-109678 freerdp3-shadow-x11: FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reac...6.5 0.0033 None reported
Routine CVE-2026-109939 freerdp3-shadow-x11: FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp...n/a 0.0033 None reported
Routine CVE-2026-109941 freerdp3: FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious...n/a 0.0033 None reported
Routine CVE-2026-109946 freerdp3: FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversi...n/a 0.0033 None reported
Routine CVE-2026-109947 freerdp3: FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RD...n/a 0.0033 None reported
Routine CVE-2026-109942 freerdp3: FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c b...n/a 0.0033 None reported
Routine CVE-2026-109952 freerdp3-shadow-x11: The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against...5.3 0.0032 None reported
Showing 1 to 25 of 56 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.