FreeRDP has rolled out version 3.31.0, closing 22 security vulnerabilities and numerous other bugs in its open-source Remote Desktop Protocol (RDP) implementation. The urgency is high: users and vendors alike are being pressed to update immediately.
FreeRDP plays a major role in enabling Linux systems, thin clients, virtual desktops, and enterprise tools to connect with Windows Remote Desktop Services. Its wide feature set—handling graphics, USB redirection, smart-card support, clipboard sharing, and authentication—means it’s exposed to multiple attack vectors. Memory mismanagement in any of those components could mean serious risks.
What Was Fixed
The new release addresses 22 issues submitted via GitHub Security Advisories—some of the identifiers include GHSA-c5gr-hmqp-pwj4, GHSA-h5w2-q35j-443h, GHSA-m85m-3qxv-63h5, among others. While not every flaw is detailed publicly, the overall tone of the release underscores that many are serious.
Some of the key fixes include corrections to bounds checking in the AVC444v2 YUV decoder, and length-validation improvements across several modules: dynamic virtual channels, Remote Desktop Gateway tunnel responses, clipboard formats, smart-card inputs, USB- and device-redirection paths. Use-after-free bugs—where memory is accessed after being released—got specific attention, particularly in the printer driver singleton and aligned memory reallocation paths.
Authentication and cryptographic protection were also tightened. Memory handling around NTLM and SSPI has been improved, signature buffer access now has stricter safeguards, fallback behavior in SPNEGO has been fixed, and error scenarios in BIO and SSL object creation now receive better handling. These are all essential, as FreeRDP is often responsible for carrying sensitive authentication exchanges.
Performance & Distribution Notes
Beyond security, version 3.31.0 delivers on performance upgrades: an optimized YUV decoder for smoother graphics in AVC and H.264, more support for hardware decoders, and a switch to the dav1d decoder for AV1 in configurations where that’s supported.
Administrators should audit any systems—clients, gateways, virtual desktop setups, or third-party software—that use FreeRDP, and install the updated version either via supported distributions or by building from source. It’s also advised to verify downloads with SHA-256 checksums and signatures. The release provides source archives, ZIPs, digital signatures, and checksums to aid in this.
Particularly vulnerable are systems that connect to RDP servers over the internet or to untrusted hosts. For those, patching immediately is essential.
What this means: Organizations relying on FreeRDP—especially in environments dealing with remote desktops across untrusted networks—can no longer postpone this update. The breadth of the fixes, in both graphics parsing and authentication modules, suggests multiple paths an attacker could take. Ensuring version 3.31.0 is deployed everywhere, and that distribution chains use verified sources, is key to staying secure in RDP-enabled infrastructures.
