CVE-2026-33995

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS). The crash is triggered during NLA connection teardown and requires a failed authentication attempt. This issue has been patched in version 3.24.2.

Updated packages bring lot of security fixes. Please see the links for additional information.

These are all security issues fixed in the freerdp-3.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

• CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
• CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
• CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
• CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
• CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
• CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
• CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
• CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
• CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
• CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
• CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
• CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
• CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
• CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
• CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
• CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
• CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

• Version 3.24.2:

  • [channels,video] fix wrong cast (#12511)
  • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
  • [client,sdl] create a copy of rdpPointer (#12512)
  • [codec,video] properly pass intermediate format (#12518)
  • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
  • [server,shadow] remember selected caps (#12528)
  • Zero credential data before free in NLA and NTLM context (#12532)
  • [server,proxy] ignore missing client in input channel (#12536)
  • [server,proxy] ignore rdpdr messages (#12537)
  • [winpr,sspi] improve kerberos logging (#12538)
  • Codec fixes (#12542)

• Version 3.24.1:

  • [warnings] fix various sign and cast warnings (#12480)
  • [client,x11] start with xfc->remote_app = TRUE; (#12491)
  • Sam file read regression fix (#12484)
  • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
  • Fix: memory leak in rdp_client_establish_keys() (#12494)
  • Fix memory leak in freerdp_settings_int_buffer_copy() on…

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.