CVE-2026-33952

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). This issue has been patched in version 3.24.2.

These are all security issues fixed in the freerdp-3.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.