CVE-2026-33983

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free…

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)
• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)
• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)
• FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-33983: fix undefined-behaviour shift and ~80 billion iteration loop (CPU denial of service) in the progressive codec; make progressive_rfx_quant_sub reject components where q1 < q2 instead of letting the BYTE subtraction underflow into a bogus numBits shift exponent, and fail the tile upgrade when it does
• CVE-2026-33984: fix out-of-bounds heap write in the CLEAR codec; update CLEAR_VBAR_ENTRY::size only after the pixel buffer realloc succeeded, so a failed realloc can no longer leave an inflated size with the old, smaller buffer

• CVE-2026-33983: fix undefined-behaviour shift and ~80 billion iteration loop (CPU denial of service) in the progressive codec; make progressive_rfx_quant_sub reject components where q1 < q2 instead of letting the BYTE subtraction underflow into a bogus numBits shift exponent, and fail the tile upgrade when it does
• CVE-2026-33984: fix out-of-bounds heap write in the CLEAR codec; update CLEAR_VBAR_ENTRY::size only after the pixel buffer realloc succeeded, so a failed realloc can no longer leave an inflated size with the old, smaller buffer

Updated packages bring lot of security fixes. Please see the links for additional information.

These are all security issues fixed in the freerdp-3.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.