3.32.0 #13477

akallabeth · 2026-09-23T07:51:15Z

akallabeth
Sep 23, 2026
Maintainer

FreeRDP version 3.32.0 is released:

As usual, the archive can be downloaded from:

https://pub.freerdp.com/releases/

New release with many user visible goodies for all of you.
There have also been lots of issues addressed to harden against protocol violations/exploits,
thanks to all the people doing in depth code reviews and security reports.

[proxy] add configuration options for /sec:ext or PROTOCOL_HYBRID_EX
[proxy] add configuration options for target certificate policy.
NOTE: This changes default behavior from accept unless denied to deny unless accepted!
Requires an update of your proxy configuration file if you rely on this.
[SDL,xfreerdp] seamless Entra/Azure integration on linux (with helper binaries)
[beta] Basic SDL client RAILS support for X11/wayland (other platforms currently
lack some features / platform integration code, as we still need some native hooks)
[RDPECAM] stops camera streams now when the remote no longer requests frames.
(no more camera LED after closing the windows application accessing it)
[RDPEWA] support user verification in addition to / instead of pin
[RDPEUSB] properly map interface index to interface numbers
(more devices should work now)
[android] updated touch pointer
[wlfreerdp] shortcut inhibit release on mouse leave window
[xfreerdp] rails improvements, hopefully no longer shrinking windows
Full support for [MS-RDPBCGR] 2.2.10.2 Early User Authorization Result PDU,
so now you get a error message if a user is not allowed to log in instead of
a network failed message. (Authentication /sec:ext or PROTOCOL_HYBRID_EX)
[shadow] add configuration options for /sec:ext or PROTOCOL_HYBRID_EX
[gateway] split HTTP timeout from TCP connect timeout
[ffmpeg] support generic hardware accelerated encoding/decoding, replacing the
old VAAPI only implementation. (still experimental as there are often driver issues)

CVE

Note: Advisories will be published days/weeks after the release, so links are 404
until then.

What's Changed

Various WinPR addings (Various WinPR addings #13311)
[cache] improve cache_resize ([cache] improve cache_resize #13317)
OSS-Fuzz: Add fuzzer for Smartcard Operations (OSS-Fuzz: Add fuzzer for Smartcard Operations #13323)
[codec,fdk] ignore decoder errors ([codec,fdk] ignore decoder errors #13324)
[codec,h264] overallocate decoder buffers ([codec,h264] overallocate decoder buffers #13326)
[warnings,s(n)printf] fix missing return value checks ([warnings,s(n)printf] fix missing return value checks #13325)
[client,common] fix TestClientRdpFile ([client,common] fix TestClientRdpFile #13333)
[winpr,library] fix mac os GetModuleFileNameA ([winpr,library] fix mac os GetModuleFileNameA #13337)
[channels,pulse] survive hot-removal of the active audio device ([channels,pulse] survive hot-removal of the active audio device #13334)
[client,common] map gatewaycredentialssource from rdp files ([client,common] map gatewaycredentialssource from rdp files #13330)
Warn fix pointer (Warn fix pointer #13341)
Relax order checks (Relax order checks #13343)
OSS-Fuzz: Add new fuzzer targets Client Rdp File processing (OSS-Fuzz: Add new fuzzer targets Client Rdp File processing #13344)
[channels,urbdrc] report the negotiated device speed ([channels,urbdrc] report the negotiated device speed #13345)
[client,x11] fix clipboard atom evaluation ([client,x11] fix clipboard atom evaluation #13347)
[client,x11] use correct count to iterate atoms ([client,x11] use correct count to iterate atoms #13349)
licensing checks & gfx surface format hacks (licensing checks & gfx surface format hacks #13351)
[channels,urbdrc] give the device speed a type ([channels,urbdrc] give the device speed a type #13352)
[core,gateway] bound ARM gateway responses by their own timeout, not TcpConnectTimeout ([core,gateway] bound ARM gateway responses by their own timeout, not TcpConnectTimeout #13327)
[codec,h264] configure ffmpeg via env variables ([codec,h264] configure ffmpeg via env variables #13316)
[winpr,image] honor bfOffBits when parsing bitmaps ([winpr,image] honor bfOffBits when parsing bitmaps #13350)
[cache,pointer] explicitly cast to void* ([cache,pointer] explicitly cast to void* #13353)
Ci warning fixes (Ci warning fixes #13354)
[client,cmdline] honor explicitly disabled multimon and smart-sizing ([client,cmdline] honor explicitly disabled multimon and smart-sizing #13331)
[client,common] eliminate dead code ([client,common] eliminate dead code #13357)
[alignment] add WINPR_PACKED_ALIGN_CAST ([alignment] add WINPR_PACKED_ALIGN_CAST #13355)
Silence cast function type (Silence cast function type #13358)
[winpr,info] add warning log for winpr debug options ([winpr,info] add warning log for winpr debug options #13359)
[winpr,align] more warnings on unsupported configurations ([winpr,align] more warnings on unsupported configurations #13360)
[winpr,ncrypt] add idLen checks ([winpr,ncrypt] add idLen checks #13361)
Msvc unaligned (Msvc unaligned #13362)
Fuzzer fixes (Fuzzer fixes #13363)
Channels nodiscard (Channels nodiscard #13366)
l10n: add Swedish Android localization (l10n: add Swedish Android localization #13365)
various cleanups and fixes (various cleanups and fixes #13368)
[client,sdl] handle Windows E0 36 as right shift ([client,sdl] handle Windows E0 36 as right shift #13369)
[client, ios] iOS client build fix ([client, ios] iOS client build fix #13083)
Cleanups september (Cleanups september #13370)
[winpr,library] implement GetModuleFileNameA on OpenBSD with getexecpath() ([winpr,library] implement GetModuleFileNameA on OpenBSD with getexecpath() #13335)
[cmake] fix building on OpenBSD ([cmake] fix building on OpenBSD #13380)
[winpr,cast] fix parentheses ([winpr,cast] fix parentheses #13379)
[winpr,library] move FreeBSD GetModuleFileNameA into function ([winpr,library] move FreeBSD GetModuleFileNameA into function #13382)
[winpr,cast] add PPC and s390x to supported ([winpr,cast] add PPC and s390x to supported #13383)
Pulse detect (Pulse detect #13384)
[codec,dsp] fix compiler warnings ([codec,dsp] fix compiler warnings #13385)
[client,common] fix POSIX command-line status options ([client,common] fix POSIX command-line status options #13372)
[codec,dsp] fix variable init for soxr ([codec,dsp] fix variable init for soxr #13386)
[codec,h264] fix broken MediaFoundation decoder build ([codec,h264] fix broken MediaFoundation decoder build #13389)
[ci,windows] enable WITH_MEDIA_FOUNDATION ([ci,windows] enable WITH_MEDIA_FOUNDATION #13390)
Scard checks (Scard checks #13395)
[client,x11] preserve requested size for ordinary windows ([client,x11] preserve requested size for ordinary windows #13373)
[client,x11] honor decorations for RemoteApp windows ([client,x11] honor decorations for RemoteApp windows #13393)
[client,x11] release pointer grab when RemoteApp loses focus ([client,x11] release pointer grab when RemoteApp loses focus #13392)
Ndr length checks (Ndr length checks #13399)
[channels,rdpear] fix missing NULL check ([channels,rdpear] fix missing NULL check #13400)
[client,android] horizontal scroll and middle click ([client,android] horizontal scroll and middle click #13401)
[client,android] add touchpad two-finger scroll ([client,android] add touchpad two-finger scroll #13402)
[core,transport] abort write hard if it fails ([core,transport] abort write hard if it fails #13404)
[core,rdstls] Fix version validation macro ([core,rdstls] Fix version validation macro #13406)
fix GDI handle leaks in wf_gdi_mem3blet (fix GDI handle leaks in wf_gdi_mem3blet #13403)
Geometry checks (Geometry checks #13407)
[core,sdl] externalize the AAD credentials in an external process ([core,sdl] externalize the AAD credentials in an external process #13340)
Winpr wcschr (Winpr wcschr #13408)
Tighten checks (Tighten checks #13410)
[channel,urbdrc] fix func_claim_all_interface, mark [[nodiscard]] ([channel,urbdrc] fix func_claim_all_interface, mark [[nodiscard]] #13411)
[utils,http] enable host verification ([utils,http] enable host verification #13412)
Unaligned eliminate (some) (Unaligned eliminate (some) #13405)
[packaging,all] enable WITH_XDG_AAD_AUTH_HELPER ([packaging,all] enable WITH_XDG_AAD_AUTH_HELPER #13413)
[core,rdstls] accept matching autoreconnect cookies ([core,rdstls] accept matching autoreconnect cookies #13414)
[core,gateway] do not require a final auth token ([core,gateway] do not require a final auth token #13418)
[rdpecam,v4l] release capture when sample requests drain ([rdpecam,v4l] release capture when sample requests drain #13417)
Stream utf16 and persistent cache fixes (Stream utf16 and persistent cache fixes #13421)
Fix usage of interface index as an interface number (Fix usage of interface index as an interface number #13419)
[core,security] add ExtSecurity to all clients and server ([core,security] add ExtSecurity to all clients and server #13415)
[uwac,client] fix invisible Wayland cursor and stuck shortcut inhibitor ([uwac,client] fix invisible Wayland cursor and stuck shortcut inhibitor #13424)
[channels,audin] fix mac/ios input validation ([channels,audin] fix mac/ios input validation #13423)
[client,x11] fix RemoteApp drop-down menus and dialog window size feedback loop ([client,x11] fix RemoteApp drop-down menus and dialog window size feedback loop #13422)
[client,sdl] RemoteApp (RAIL) support for the SDL3 client ([client,sdl] RemoteApp (RAIL) support for the SDL3 client #13133)
[client,sdl] generate xdg glue code without warnings ([client,sdl] generate xdg glue code without warnings #13425)
[ci,packaging] fix deb control dependencies ([ci,packaging] fix deb control dependencies #13426)
Proxy drdynvc (Proxy drdynvc #13434)
[client,sdl] add new events from SDL 3.3.2 and newer ([client,sdl] add new events from SDL 3.3.2 and newer #13435)
set_termianl_nonblock -> set_terminal_nonblock (set_termianl_nonblock -> set_terminal_nonblock #13428)
Oauth2 state tracking (Oauth2 state tracking #13433)
[winpr,utils] SAM parser: zero memory before free ([winpr,utils] SAM parser: zero memory before free #13436)
Client common context checks (Client common context checks #13438)
no Password: prompt and don't mess with tty if stdin is a pipe (no Password: prompt and don't mess with tty if stdin is a pipe #13437)
[client,common] fix inverted assert ([client,common] fix inverted assert #13439)
[channels,rdpdr] add a workaround for windows server 2003 and XP ([channels,rdpdr] add a workaround for windows server 2003 and XP #13445)
[client,common] implement common client AAD helper ([client,common] implement common client AAD helper #13441)
Kbd mapping config (Kbd mapping config #13444)
[client,common] unify aad token navigation code ([client,common] unify aad token navigation code #13446)
[client,common] fix arguments order ([client,common] fix arguments order #13447)
Tsg and cleanups (Tsg and cleanups #13448)
Harden (Harden #13451)
sysinfo.c: fix macOS cpu macros (sysinfo.c: fix macOS cpu macros #13452)
reject unterminated applicationId in rail get appid resp (reject unterminated applicationId in rail get appid resp #13453)
Harden more (Harden more #13456)
SDL3: fix typo (SDL3: fix typo #13462)
[core,server] sanitize KeyboardType received from clients ([core,server] sanitize KeyboardType received from clients #13461)
[memory] prefer winpr_aligned_calloc ([memory] prefer winpr_aligned_calloc #13466)
[server,proxy] add TargetCertPolicy config option ([server,proxy] add TargetCertPolicy config option #13463)
OSS-Fuzz: Disable libpulse manually for oss-fuzz build (OSS-Fuzz: Disable libpulse manually for oss-fuzz build #13465)
Harden again (Harden again #13464)
[client,x11] fix RAIL window repaint volume (invalid region never reset, updates for unmapped windows) ([client,x11] fix RAIL window repaint volume (invalid region never reset, updates for unmapped windows) #13459)
Warn cleanup (Warn cleanup #13467)
Warn cleanup (Warn cleanup #13467)
Refinements (Refinements #13468)
Refinements some more (Refinements some more #13469)
[codec,dsp] fix fdk-aac encoding ([codec,dsp] fix fdk-aac encoding #13470)
Cleanups (Cleanups #13471)
[core,gateway] never pass NULL to websocket_reply_close ([core,gateway] never pass NULL to websocket_reply_close #13474)
[core,fastpath] add fastpath errors to relax-order-checks ([core,fastpath] add fastpath errors to relax-order-checks #13476)

New Contributors

@shakeelosmani made their first contribution in ([channels,pulse] survive hot-removal of the active audio device #13334)
@sjtrotter made their first contribution in ([client,common] map gatewaycredentialssource from rdp files #13330)
@huanzhang12 made their first contribution in ([winpr,image] honor bfOffBits when parsing bitmaps #13350)
@yeager made their first contribution in (l10n: add Swedish Android localization #13365)
@Ohyunj made their first contribution in (fix GDI handle leaks in wf_gdi_mem3blet #13403)
@yerbolgmailcom made their first contribution in ([rdpecam,v4l] release capture when sample requests drain #13417)
@slavaandrejev made their first contribution in (Fix usage of interface index as an interface number #13419)
@berkeleyinc made their first contribution in ([uwac,client] fix invisible Wayland cursor and stuck shortcut inhibitor #13424)
@unicon221 made their first contribution in ([client,x11] fix RemoteApp drop-down menus and dialog window size feedback loop #13422)
@barracuda156 made their first contribution in (sysinfo.c: fix macOS cpu macros #13452)
@gaardiolor made their first contribution in ([core,server] sanitize KeyboardType received from clients #13461)
@arthgirard made their first contribution in ([client,x11] fix RAIL window repaint volume (invalid region never reset, updates for unmapped windows) #13459)

For a complete and detailed change log since the last release run:
git log 3.32.0...3.31.1

This discussion was created from the release 3.32.0.

Navigation Menu

3.32.0 #13477

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

3.32.0 #13477

Uh oh!

akallabeth Sep 23, 2026 Maintainer

CVE

What's Changed

New Contributors

Replies: 0 comments

akallabeth
Sep 23, 2026
Maintainer