CVE-2026-33985

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

• FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

• FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

• FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

• FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)
• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)
• FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)
• FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-33985: fix information leak in ClearCodec glyph index decode; validate nWidth*nHeight for overflow and update glyphEntry->count only after a successful realloc so subsequent reads cannot expose adjacent heap memory
• CVE-2022-39283: fix missing length check in /video channel data handler; verify the stream contains cbSample bytes before using Stream_Pointer(), preventing decode of uninitialized data past the received payload
• CVE-2022-39282: fix length handling in /parallel driver; zero-initialize the read buffer with calloc and return only the bytes actually read from the port, preventing leakage of uninitialized client memory to the server

Updated packages bring lot of security fixes. Please see the links for additional information.

These are all security issues fixed in the freerdp-3.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.