Every CVE Search/ Get API key

CVE-2026-29776

FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library

3.1 LowFix available

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.18%Up 0.2 points since Mar 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-191, CWE-400, CWE-789
Updated
2026-11-02
EUVDEUVD-2026-12059 3.1

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
EUVD-2026-12059
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
NVD 3.1

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-191, CWE-400, CWE-789
Updated
2026-11-02
OSVALPINE-CVE-2026-29776 3.1

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
ALPINE-CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSV 3.1

FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-191, CWE-400, CWE-789
Updated
2026-11-02
OSVDEBIAN-CVE-2026-29776 3.1

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
DEBIAN-CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2026-1716 3.1

freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.(CVE-2026-29776)

Record
OESA-2026-1716
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-29776 3.1

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.

Record
UBUNTU-CVE-2026-29776
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:10408-1 No score

freerdp-3.24.1-1.1 on GA media

These are all security issues fixed in the freerdp-3.24.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10408-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20657-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

  • CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
  • CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
  • CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
  • CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
  • CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
  • CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
  • CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
  • CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
  • CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
  • CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
  • CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
  • CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
  • CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
  • CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
  • CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
  • CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
  • CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
  • CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
  • CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
  • CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
  • CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

  • Version 3.24.2:

    • [channels,video] fix wrong cast (#12511)
    • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
    • [client,sdl] create a copy of rdpPointer (#12512)
    • [codec,video] properly pass intermediate format (#12518)
    • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
    • [server,shadow] remember selected caps (#12528)
    • Zero credential data before free in NLA and NTLM context (#12532)
    • [server,proxy] ignore missing client in input channel (#12536)
    • [server,proxy] ignore rdpdr messages (#12537)
    • [winpr,sspi] improve kerberos logging (#12538)
    • Codec fixes (#12542)

  • Version 3.24.1:

    • [warnings] fix various sign and cast warnings (#12480)
    • [client,x11] start with xfc->remote_app = TRUE; (#12491)
    • Sam file read regression fix (#12484)
    • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
    • Fix: memory leak in rdp_client_establish_keys() (#12494)
    • Fix memory leak in freerdp_settings_int_buffer_copy() on…
Record
openSUSE-SU-2026:20657-1
Updated
2026-11-02
OSVSUSE-SU-2026:1632-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1632-1
Updated
2026-11-02
OSVSUSE-SU-2026:1633-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: Heap-use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1633-1
Updated
2026-11-02
OSVSUSE-SU-2026:1634-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1634-1
Updated
2026-11-02
OSVSUSE-SU-2026:1635-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1635-1
Updated
2026-11-02
OSVSUSE-SU-2026:1640-1 No score

Security update for freerdp2

This update for freerdp2 fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27951: Denial of Service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1640-1
Updated
2026-11-02
OSVSUSE-SU-2026:21436-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

  • CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
  • CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
  • CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
  • CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
  • CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
  • CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
  • CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
  • CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
  • CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
  • CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
  • CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
  • CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
  • CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
  • CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
  • CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
  • CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
  • CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
  • CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
  • CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
  • CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
  • CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

  • Version 3.24.2:

    • [channels,video] fix wrong cast (#12511)
    • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
    • [client,sdl] create a copy of rdpPointer (#12512)
    • [codec,video] properly pass intermediate format (#12518)
    • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
    • [server,shadow] remember selected caps (#12528)
    • Zero credential data before free in NLA and NTLM context (#12532)
    • [server,proxy] ignore missing client in input channel (#12536)
    • [server,proxy] ignore rdpdr messages (#12537)
    • [winpr,sspi] improve kerberos logging (#12538)
    • Codec fixes (#12542)

  • Version 3.24.1:

    • [warnings] fix various sign and cast warnings (#12480)
    • [client,x11] start with xfc->remote_app = TRUE; (#12491)
    • Sam file read regression fix (#12484)
    • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
    • Fix: memory leak in rdp_client_establish_keys() (#12494)
    • Fix memory leak in freerdp_settings_int_buffer_copy() on…
Record
SUSE-SU-2026:21436-1
Updated
2026-11-02
OSVUSN-8561-1 No score

freerdp3 vulnerabilities

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.

Record
USN-8561-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp
Alpine:v3.23
 before 3.24.0-r0
3.24.0-r0
freerdp
Alpine:v3.24
 before 3.24.0-r0
3.24.0-r0
freerdp2
Debian:12
 All versions, plus listed versions
2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2
Show 8 moreShow less
2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1
 None known
freerdp3
Debian:13
 before 3.15.0+dfsg-2.1+deb13u2, plus listed versions
3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u1
3.15.0+dfsg-2.1+deb13u2
freerdp3
Debian:14
 before 3.24.0+dfsg-1, plus listed versions
3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1
Show 16 moreShow less
3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+1
3.24.0+dfsg-1
freerdp
openEuler:22.03-LTS-SP4
 before 2.11.8-2.oe2203sp4
2.11.8-2.oe2203sp4
freerdp
openEuler:24.03-LTS
 before 2.11.8-2.oe2403sp3
2.11.8-2.oe2403sp3
freerdp
openEuler:24.03-LTS-SP1
 before 2.11.8-2.oe2403sp1
2.11.8-2.oe2403sp1
freerdp
openEuler:24.03-LTS-SP2
 before 2.11.8-2.oe2403sp2
2.11.8-2.oe2403sp2
freerdp
openEuler:24.03-LTS-SP3
 before 2.11.8-2.oe2403sp3
2.11.8-2.oe2403sp3
Show 12 moreShow less
Affected packages
PackageAffectedFixed
freerdp
openEuler:20.03-LTS-SP4
 before 2.11.8-2.oe2003sp4
2.11.8-2.oe2003sp4
freerdp
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
 None known
freerdp2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6
Show 14 moreShow less
2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6
 None known
freerdp
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
 None known
freerdp2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1
Show 12 moreShow less
2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4
 None known
freerdp2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1
Show 18 moreShow less
2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11
 None known
freerdp3
Ubuntu:24.04:LTS
 before 3.30.0+dfsg-0ubuntu0.24.04.1, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1
Show 5 moreShow less
3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.6
3.30.0+dfsg-0ubuntu0.24.04.1
freerdp2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1
Show 7 moreShow less
2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6
 None known
freerdp3
Ubuntu:25.10
 All versions, plus listed versions
3.14.0+dfsg-1ubuntu13.15.0+dfsg-2.13.16.0+dfsg-1ubuntu13.16.0+dfsg-23.16.0+dfsg-2ubuntu0.13.16.0+dfsg-2ubuntu0.33.16.0+dfsg-2ubuntu0.43.16.0+dfsg-2ubuntu0.5
 None known
freerdp3
Ubuntu:24.04:LTS
From an advisory covering 34 CVEs
 before 3.30.0+dfsg-0ubuntu0.24.04.1, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1
Show 5 moreShow less
3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.6
3.30.0+dfsg-0ubuntu0.24.04.1
freerdp3
Ubuntu:26.04:LTS
From an advisory covering 34 CVEs
 before 3.30.0+dfsg-0ubuntu0.26.04.1, plus listed versions
3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1
Show 6 moreShow less
3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.1
3.30.0+dfsg-0ubuntu0.26.04.1
freerdp
openSUSE:Tumbleweed
From an advisory covering 19 CVEs
 before 3.24.1-1.1
3.24.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29776 is a low vulnerability (CVSS 3.1) in Freerdp, published March 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in freerdp 3.24.0-r0.

References

Show 108 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open