Skip to contentFreerdp vulnerabilities
Newest
- freerdpFreeRDP before 3.29.0 TLS Certificate EKU BypassCVE-2026-67294Fix available9.3 Critical
- freerdpFreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionCVE-2026-67289Fix available9.3 Critical
- freerdpFreeRDP before 3.29.0 TLS Certificate Identity Validation BypassCVE-2026-66402Fix available9.3 Critical
- freerdpFreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via CliprdrCVE-2026-673059.4 Critical
- freerdpFreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxyCVE-2026-67301Fix available8.7 High
- freerdpFreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP responseCVE-2026-67297Fix available8.7 High
- freerdpFreeRDP before 3.29.0 Improper Certificate Hostname ValidationCVE-2026-67293Fix available9.3 Critical
- freerdpFreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMFCVE-2026-67290Fix available8.7 High
- freerdpFreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDUCVE-2026-63652Fix available7.1 High
- freerdpFreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→clientCVE-2026-63633Fix available7.7 High
- freerdpFreeRDP: Denial of service through ADPCM frame size calculationCVE-2026-63117Fix available6.5 Medium
- freerdpFreeRDP RDP File Parser Remote Code Execution via CLI OptionsCVE-2026-64624Fix available8.5 High
- freerdpFreeRDP before 3.28.0 Double-Free via selectedmonitorsCVE-2026-64621Fix available9.3 Critical
- freerdpFreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_commonCVE-2026-64620Fix available9.3 Critical
- freerdpFreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsingCVE-2026-57156Fix available8.6 High
- freerdpOut-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelNameCVE-2026-57157Fix available6.5 Medium
- freerdpFreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530CVE-2026-57158Fix available5.1 Medium
- freerdpFreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragmentsCVE-2026-55564Fix available5.4 Medium
- freerdpFreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel CallbackCVE-2026-56297Fix available8.3 High
- freerdpFreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decodeCVE-2026-55827Fix available7.5 High
- freerdpFreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds CheckCVE-2026-55648Fix available6.1 Medium
- freerdpFreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatchCVE-2026-55194Fix available8.7 High
- freerdpFreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_fragCVE-2026-55193Fix available8.7 High
- freerdpFreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatchCVE-2026-55192Fix available7.2 High
- freerdpFreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocationCVE-2026-55191Fix available8.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 moreHeap-buffer-overflow write in planar bitmap decoderCVE-2026-45700Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSCVE-2026-44420Fix available8.8 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusionCVE-2026-44422Fix available7.5 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypassCVE-2026-44421Fix available8.8 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypassCVE-2026-40033Fix available8.6 High
- freerdpFreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..CVE-2026-40254Fix available4.2 Medium
- freerdpFreeRDP: Possible double free in kerberos_AcceptSecurityContextCVE-2026-33995Fix available5.3 Medium
- freerdpFreeRDP: Persistent Cache bmpSize Desync - Heap OOB WriteCVE-2026-33987Fix available7.1 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteCVE-2026-33986Fix available7.5 High
- freerdpFreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB ReadCVE-2026-33985Fix available5.9 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: ClearCodec resize_vbar_entry() Heap OOB WriteCVE-2026-33984Fix available7.5 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoSCVE-2026-33983Fix available6.5 Medium
- freerdpFreeRDP: Persistent Cache Allocator Mismatch - Heap OOB ReadCVE-2026-33982Fix available7.1 High
- freerdpFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checksCVE-2026-33952Fix available6.0 Medium
- freerdpFreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)CVE-2026-33977Fix available6.9 Medium
- freerdpFreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`CVE-2026-31897Fix available0.0 None
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap DimensionsCVE-2026-31806Fix available9.3 Critical
- freerdpFreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checksCVE-2026-31885Fix available6.5 Medium
- freerdpFreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0CVE-2026-31884Fix available6.5 Medium
- freerdpFreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow writeCVE-2026-31883Fix available6.5 Medium
- freerdpFreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryCVE-2026-29776Fix available3.1 Low
- freerdpFreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheIdCVE-2026-29775Fix available5.3 Medium
- freerdpFreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRectsCVE-2026-29774Fix available5.3 Medium
- freerdpFreeRDP has possible Integer overflow in Stream_EnsureCapacityCVE-2026-27951Fix available5.3 Medium
- freerdpFreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong FileCVE-2026-27950Fix available5.5 Medium
- Show moreLoading…