FreeRDP-3.26.0

[Bruce Dubbs]

New minor version.

[Joe Locash]

3.26.0

Mostly a bugfix and maintenance release with a few nice additions:

• On mac os the H264 decoder now supports VideoToolbox
• The android client got a big overhaul, more has been promised

CVE fixes

• 3 High ranking CVE, no numbers assigned yet. Monitor ​https://github.com/FreeRDP/FreeRDP/security/advisories for updates

What's Changed

• cmake: Findyuv: Use correct pkgconfig name
• Remove deallocator attribute from rfx_message_free
• [winpr,utils] improve winpr/ntlm.h
• rdpecam-v4l: stop the capture thread when streaming is cleared
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon
• [core,instance] fix deprecation guards
• [ci,alt-arch] enable internal MD4, MD5 and RC4
• Add VideoToolbox H.264 support for ffmpeg
• [client,common] add /args-from:file: syntax
• [ci,freebsd] update freebsd builds
• [client, android] UI modernization, SQLCipher and more
• [cmake,deps] use alias target for sso-mib
• [core,settings] add auto reconnect triggered flag
• Force YUV420P when videotoolbox is used
• Release cleanups
• [gdi,gfx] fix bounds checks and proxy unit tests
• Improved input checks
• [winpr,utils] add unit tests for command line parser
• Cmdline fixes
• [codec,planar] fix bounds checks
• [client,common] add freerdp_client_settings_parse_command_line_argume…
• [winpr,sspi] clean up ntlm code

[Joe Locash]

Fixed at b502b0cd3c. Leaving open for SA.

[Douglas R. Reno]

• CVE-2026-44420 (8.8 High): FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS. RCE and DoS
• CVE-2026-45700 (8.8 High): Heap-buffer-overflow write in planar bitmap decoder. RCE and DoS
• ​https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff - "

FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass"... no CVE assigned, but 8.8 High rating assigned. DoS and possible RCE.

• ​https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j9q5-7g8m-jc9v - "FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion"... 7.5 High rating assigned, no CVE assigned. Type confusion causing possible RCE, but primary impact is DoS.

[Douglas R. Reno]

SA-13.0-086 issued