freerdp vulnerabilities (Ubuntu)
297 vulnerabilities.
freerdpUbuntuFreeRDP before 3.29.0 Path Traversal via drive redirection5.3 MediumfreerdpUbuntuFreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure9.3 CriticalfreerdpUbuntuFreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 Denial of Service via smartcard cache8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.2642.4 LowfreerdpUbuntuFreeRDP before 3.29.0 NULL Dereference via smartcard cleanup8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 Denial of Service via RDPEI PDU8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 TLS Certificate EKU Bypass9.3 CriticalfreerdpUbuntuFreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection9.3 CriticalfreerdpUbuntuFreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass9.3 CriticalfreerdpUbuntuFreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response8.7 HighfreerdpUbuntuFreeRDP before 3.29.0 Improper Certificate Hostname Validation9.3 CriticalfreerdpUbuntuFreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF8.7 HighfreerdpUbuntuFreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU7.1 HighfreerdpUbuntuFreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client7.7 HighfreerdpUbuntuFreeRDP: Denial of service through ADPCM frame size calculation6.5 MediumfreerdpUbuntuFreeRDP RDP File Parser Remote Code Execution via CLI Options8.5 HighfreerdpUbuntuFreeRDP before 3.28.0 Double-Free via selectedmonitors9.3 CriticalfreerdpUbuntuFreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common9.3 CriticalfreerdpUbuntuFreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing8.6 HighfreerdpUbuntuOut-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName6.5 MediumfreerdpUbuntuFreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-235305.1 MediumfreerdpUbuntuFreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments5.4 MediumfreerdpUbuntuFreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback8.3 HighfreerdpUbuntuFreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode7.5 HighfreerdpUbuntuFreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check6.1 MediumfreerdpUbuntuFreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch8.7 HighfreerdpUbuntuFreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag8.7 HighfreerdpUbuntuFreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch7.2 HighfreerdpUbuntuFreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation8.7 HighfreerdpUbuntuFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS8.8 HighfreerdpUbuntuFreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion7.5 HighfreerdpUbuntuFreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass8.8 HighfreerdpUbuntuFreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass8.6 HighfreerdpUbuntuFreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..4.2 MediumfreerdpUbuntuFreeRDP: Possible double free in kerberos_AcceptSecurityContext5.3 MediumfreerdpUbuntuFreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write7.1 HighfreerdpUbuntuFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write7.5 HighfreerdpUbuntuFreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read5.9 MediumfreerdpUbuntuFreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write7.5 HighfreerdpUbuntuFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS6.5 MediumfreerdpUbuntuFreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read7.1 HighfreerdpUbuntuFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks6.0 MediumfreerdpUbuntuFreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)6.9 MediumfreerdpUbuntuFreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`0.0 NonefreerdpUbuntuFreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions9.3 CriticalfreerdpUbuntuFreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks6.5 MediumfreerdpUbuntuFreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 06.5 MediumfreerdpUbuntuFreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write6.5 Medium- Show moreLoading…