CVE-2026-27951

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the…

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)

• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)

• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation this will only work on 32bit systems where the available physical memory is >= SIZE_MAX. Version 3.23.0 contains a patch. No known workarounds are available.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
• freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
• freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
• freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
• freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
• freerdp: FreeRDP has a division-by-zero in ADPCM decoders when nBlockAlign is 0 (CVE-2026-31884)
• freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
• FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated packages bring lot of security fixes. Please see the links for additional information.

These are all security issues fixed in the freerdp2-2.11.7-8.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp2 fixes the following issues:

Changes in freerdp2:

• Update freerdp-3-macro:

  • Add WINPR_ATTR_MALLOC macro from freerdp 3

• Security fixes for the following issues:

  • CVE-2026-25941: Fixed a out of bounds read (bsc#1258919)
  • CVE-2026-25942: Fixed a buffer overflow in xf_rail_server_execute_result() (bsc#1258920)
  • CVE-2026-27951: Fixed a denial of service in Stream_EnsureCapacity() (bsc#1258939)
  • CVE-2026-25997: Fixed a use-after-free in xf_clipboard_format_equal() (bsc#1258977)
  • CVE-2026-26986: Fixed a use-after-free in rail_window_free() (bsc#1258967)
  • CVE-2026-27015: Fixed a client denial of service via reachable assert (bsc#1258987)
  • CVE-2026-25952: Fixed a use-after-free in xf_SetWindowMinMaxInfo() (bsc#1258921)
  • CVE-2026-25953: Fixed a use-after-free in xf_AppUpdateWindowFromSurface() (bsc#1258923)
  • CVE-2026-25954: Fixed a use-after-free in xf_rail_server_local_move_size() (bsc#1258924)
  • CVE-2026-24684: Fixed a use-after-free in play_thread() (bsc#1257991).
  • CVE-2026-26271: Fixed a buffer overread in icon processing (bsc#1258979)
  • CVE-2026-26955: Fixed a out of bounds write (bsc#1258982)
  • CVE-2026-26965: Fixed a out of bounds write (bsc#1258985)
  • CVE-2026-31806: Fixed a buffer overflow via improper validation of server messages (bsc#1259653)
  • CVE-2026-31883: Fixed a buffer overflow via crafted audio format and wave data (bsc#1259679)
  • CVE-2026-31885: Fixed a out of bounds read (bsc#1259686)
  • CVE-2026-24491: Fix use-after-free that was accidentally introduced in the backport (bsc#1257981)
  • CVE-2026-22855: Fixed a buffer overflow in smartcard_unpack_set_attrib_call() (bsc#1256721)
  • CVE-2026-22857: Fixed a use-after-free in irp_thread_func() (bsc#1256723)
  • CVE-2026-23533: Fixed a buffer overflow in clear_decompress_residual_data() (bsc#1256943)
  • CVE-2026-23732: Fixed a buffer overflow in Glyph_Alloc() (bsc#1256945)
  • CVE-2026-23883: Fixed a use-after-free (bsc#1256946)
  • CVE-2026-23884: Fixed a use-after-free in gdi_set_bounds (bsc#1256947)

This update for freerdp fixes the following issues:

• CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
• CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
• CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
• CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
• CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
• CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
• CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

This update for freerdp fixes the following issues:

• CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
• CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25955: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
• CVE-2026-25959: Heap-use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
• CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
• CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
• CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).
• CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
• CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
• CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
• CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

This update for freerdp fixes the following issues:

• CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
• CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
• CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
• CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
• CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
• CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
• CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

This update for freerdp fixes the following issues:

• CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
• CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
• CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
• CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
• CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
• CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
• CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

This update for freerdp2 fixes the following issues:

• CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
• CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
• CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
• CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
• CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
• CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
• CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
• CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
• CVE-2026-27951: Denial of Service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
• CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
• CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
• CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).

This update for freerdp fixes the following issues:

• CVE-2026-27951: 32-bit system denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
• CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
• CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
• CVE-2026-33982: heap buffer overread in winpr_aligned_offset_recalloc() can lead to undefined behavior (bsc#1261222).
• CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
• CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
• CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
• CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
• CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
• CVE-2026-33995: double-free in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).
• CVE-2026-40033: heap buffer overflow in gdi_CacheToSurface allows attackers to cause a denial of service or achieve remote code execution (bsc#1266317).
• CVE-2026-40254: off-by-one error in contains_dotdot() allows for drive channel path traversal (bsc#1262743).
• CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends a CB_CLIP_CAPS PDU with a too-small capabilitySetLength (bsc#1267008).
• CVE-2026-44421: improper validation in gdi_CacheToSurface can lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009).
• CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
• CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
• CVE-2026-56297: improper synchronization of channel_callback access can lead to use-after-free in dvcman_channel_close and dvcman_call_on_receive triggered by a malicious RDP server (bsc#1271071).
• CVE-2026-57156: integer overflow in update_read_delta_points allows malicious RDP peers to cause a heap buffer overflow (bsc#1271303).
• CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM DeviceName and VirtualChannelName fields (bsc#1271304).
• CVE-2026-57158: incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only allows a malicious RDP server to trigger a one byte buffer overflow via a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload (bsc#1271305).

It was discovered that FreeRDP incorrectly handled certain RDP packets. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.