CVE-2026-67298

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

8.7 HighFix available

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.72%Up 0.3 points since Aug 2, 2026

What each source reports

CVE List Score used 8.7

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

Record: CVE-2026-67298
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-191
Updated: 2026-11-02

EUVDEUVD-2026-51824 8.7

Record: EUVD-2026-51824
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wrfm-6x9r-42cr 8.7

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL...

Record: GHSA-wrfm-6x9r-42cr
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-191
Updated: 2026-11-02

NVD 8.7

Record: CVE-2026-67298
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-191
Updated: 2026-11-04

OSV 8.7

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

Record: CVE-2026-67298
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-191
Updated: 2026-11-05

OSVDEBIAN-CVE-2026-67298 8.7

Record: DEBIAN-CVE-2026-67298
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-04

Show 6 moreShow less

OSVRHSA-2026:61378 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:61378
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68706 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:68706
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68707 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:68707
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:61378 8.8

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)
FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)
FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)
FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)
FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)
FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)
freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:61378
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-67298 8.7

Record: UBUNTU-CVE-2026-67298
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2026:61378 No score

Important: freerdp security update

Security Fix(es):

FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)
FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)
FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)
FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)
FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)
FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)
freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:61378
Updated: 2026-11-02

Affected products

freerdp

Affected packages

Affected packages
Package	Affected	Fixed
`freerdp` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-devel` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-libs` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-server` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`libwinpr` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`libwinpr-devel` AlmaLinux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp2` Debian:12	All versions, plus listed versions 2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2 Show 8 moreShow less 2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1	None known
`freerdp3` Debian:13	All versions, plus listed versions 3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1 Show 45 moreShow less 3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-13.32.1+dfsg-13.32.1+dfsg-1~bpo13+13.32.2+dfsg-1	None known
`freerdp3` Debian:14	before 3.29.0+dfsg-1, plus listed versions 3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1 Show 32 moreShow less 3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-2	3.29.0+dfsg-1
`freerdp` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`freerdp-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-debugsource` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-libs` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-server-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`libwinpr` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`libwinpr-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-devel` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp-server` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`libwinpr-devel` Red Hat:enterprise_linux:10.2 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-debugsource` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-libs` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-libs-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-server-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`libwinpr` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`libwinpr-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-devel` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp-server` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`libwinpr-devel` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 14 CVEs	before 2:3.10.3-3.el10_0.16	2:3.10.3-3.el10_0.16
`freerdp` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`freerdp-debuginfo` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`freerdp-libs` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`libwinpr` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`freerdp-devel` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`libwinpr-devel` Red Hat:rhel_els:7 From an advisory covering 7 CVEs	before 0:2.1.1-5.el7_9.12	0:2.1.1-5.el7_9.12
`freerdp` Rocky Linux:10 From an advisory covering 13 CVEs	before 2:3.10.3-12.el10_2.10	2:3.10.3-12.el10_2.10
`freerdp` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4	None known
`freerdp2` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6 Show 14 moreShow less 2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6	None known
`freerdp` Ubuntu:18.04:LTS	All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2	None known
`freerdp2` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1 Show 12 moreShow less 2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4	None known
`freerdp2` Ubuntu:22.04:LTS	All versions, plus listed versions 2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1 Show 18 moreShow less 2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11	None known
`freerdp3` Ubuntu:24.04:LTS	before 3.30.0+dfsg-0ubuntu0.24.04.1, plus listed versions 3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1 Show 5 moreShow less 3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.6	3.30.0+dfsg-0ubuntu0.24.04.1
`freerdp2` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1 Show 7 moreShow less 2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6	None known
`freerdp3` Ubuntu:26.04:LTS	before 3.30.0+dfsg-0ubuntu0.26.04.1, plus listed versions 3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1 Show 6 moreShow less 3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.1	3.30.0+dfsg-0ubuntu0.26.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 4, 2026	affected	OSV
Nov 4, 2026	facts, references	NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-67298 is a high vulnerability (CVSS 8.7) in Freerdp, published August 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in freerdp3 3.29.0+dfsg-1.

References

Show 124 moreShow less

This page doesn't list everything

Left out here: 1 version. The JSON record has them.