CVE-2026-40254

These are all security issues fixed in the freerdp-3.26.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues

Update to version 3.26.0:

• CVE-2026-33982: heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc() (bsc#1261222).
• CVE-2026-33985: FreeRDP: Information disclosure via heap memory out of bounds read (bsc#1261217).
• CVE-2026-33986: heap OOB write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap OOB write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote execute code (bsc#1266317).
• CVE-2026-40254: off-by-one in contains_dotdot() allows drive channel path traversal (bsc#1262743).
• CVE-2026-44420: Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server- side clipboard (cliprdr) channel (bsc#1267008).
• CVE-2026-44421: Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: Prior to 3.26.0, a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path exists (bsc#1267010).
• CVE-2026-45700: n attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData (bsc#1267011).

Changes:

• cmake: Findyuv: Use correct pkgconfig name (#12666)
• Remove deallocator attribute from rfx_message_free (#12681)
• [winpr,utils] improve winpr/ntlm.h (#12677)
• rdpecam-v4l: stop the capture thread when streaming is cleared (#12690)
• fix(winpr,ncrypt): support PIV retired key slots for smartcard logon (#12684)
• [core,instance] fix deprecation guards (#12691)
• [ci,alt-arch] enable internal MD4, MD5 and RC4 (#12692)
• Add VideoToolbox H.264 support for ffmpeg (#12694)
• [client,common] add /args-from:file: syntax (#12697)
• [ci,freebsd] update freebsd builds (#12698, #12700, #12701, #12702)
• [client, android] UI modernization, SQLCipher and more (#12685, #12686, #12687, #12730,
• #12731, #12736, #12737, #12688)
• [cmake,deps] use alias target for sso-mib (#12706)
• [core,settings] add auto reconnect triggered flag (#12709)
• Force YUV420P when videotoolbox is used (#12711)
• Release cleanups (#12712)
• [gdi,gfx] fix bounds checks and proxy unit tests (#12713)
• Improved input checks (#12714)
• [winpr,utils] add unit tests for command line parser (#12716)
• Cmdline fixes (#12717)
• [codec,planar] fix bounds checks (#12718)
• [client,common] add freerdp_client_settings_parse_command_line_argume... (#12724)
• [winpr,sspi] clean up ntlm code (#12732)
• Experimental AV1 support has been added. This currently works only with FreeRDP based servers.
• Most notably there is now support for [MS-RDPEWA] (FIDO2 redirection)
• Android client received a (small) facelift
• Improved SDL3 client drawing performance
• Console output support for SDL3 (windows) and windows native client
• RDP proxy now supports NSCodec and RFX modes.
• RDP PRoxy now has smartcard emulation and SAM file support (via config file)
• Smartcard KSP support for NLA authentication
• [winpr,wlog] add WLog_SetGlobalPrefix (#12497)
• [channels,video] fix wrong cast (#12511)
• [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
• [client,sdl] create a copy of rdpPointer (#12512)
• [codec,video] properly pass intermediate format (#12518)
• [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520)
• winpr: improve libunwind backtraces (#12530)
• [server,shadow] remember selected caps (#12528)
• Zero credential data before free in NLA and NTLM context (#12532) *…

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.