# FreeRDP.

Every CVE that names FreeRDP among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions](https://agentprime.io/advisories/CVE-2026-91955.md)
  `CVE-2026-91955` · CVE record: FreeRDP FreeRDP · CVSS 8.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec](https://agentprime.io/advisories/CVE-2026-91954.md)
  `CVE-2026-91954` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO](https://agentprime.io/advisories/CVE-2026-91953.md)
  `CVE-2026-91953` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP before 3.31.0 Denial of Service via pool_decode_rect](https://agentprime.io/advisories/CVE-2026-91952.md)
  `CVE-2026-91952` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc](https://agentprime.io/advisories/CVE-2026-91951.md)
  `CVE-2026-91951` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound](https://agentprime.io/advisories/CVE-2026-91950.md)
  `CVE-2026-91950` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass](https://agentprime.io/advisories/CVE-2026-91949.md)
  `CVE-2026-91949` · CVE record: FreeRDP FreeRDP · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL](https://agentprime.io/advisories/CVE-2026-91948.md)
  `CVE-2026-91948` · CVE record: FreeRDP FreeRDP · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC](https://agentprime.io/advisories/CVE-2026-91947.md)
  `CVE-2026-91947` · CVE record: FreeRDP FreeRDP · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Race condition
- [FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics](https://agentprime.io/advisories/CVE-2026-91946.md)
  `CVE-2026-91946` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR](https://agentprime.io/advisories/CVE-2026-91945.md)
  `CVE-2026-91945` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444](https://agentprime.io/advisories/CVE-2026-85090.md)
  `CVE-2026-85090` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory](https://agentprime.io/advisories/CVE-2026-85089.md)
  `CVE-2026-85089` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [FreeRDP: Heap buffer overflow in Opus audio decode (\`freerdp_dsp_decode_opus\` resizes the wrong stream) — server→client](https://agentprime.io/advisories/CVE-2026-63633.md)
  `CVE-2026-63633` · CVE record: FreeRDP FreeRDP · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Double-free of \`client_formats\` in the rdpsnd server channel on a malformed Client Audio Formats PDU](https://agentprime.io/advisories/CVE-2026-63652.md)
  `CVE-2026-63652` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Denial of service through ADPCM frame size calculation](https://agentprime.io/advisories/CVE-2026-63117.md)
  `CVE-2026-63117` · CVE record: FreeRDP FreeRDP · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service
- [FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch](https://agentprime.io/advisories/CVE-2026-55192.md)
  `CVE-2026-55192` · CVE record: FreeRDP FreeRDP · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch](https://agentprime.io/advisories/CVE-2026-55194.md)
  `CVE-2026-55194` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Integer Overflow in \`freerdp_image_copy_from_icon_data\` Bypasses Bounds Check](https://agentprime.io/advisories/CVE-2026-55648.md)
  `CVE-2026-55648` · CVE record: FreeRDP FreeRDP · CVSS 6.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag](https://agentprime.io/advisories/CVE-2026-55193.md)
  `CVE-2026-55193` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments](https://agentprime.io/advisories/CVE-2026-55564.md)
  `CVE-2026-55564` · CVE record: FreeRDP FreeRDP · CVSS 5.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption, CWE-193
- [FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation](https://agentprime.io/advisories/CVE-2026-55191.md)
  `CVE-2026-55191` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FreeRDP: Kerberos GSS Wrap-token \`EC\` field is unbounded, causing an out-of-bounds decrypt in \`kerberos_DecryptMessage\`](https://agentprime.io/advisories/CVE-2026-73242.md)
  `CVE-2026-73242` · CVE record: FreeRDP FreeRDP · CVSS 8.3 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open \`resultCode\`)](https://agentprime.io/advisories/CVE-2026-73241.md)
  `CVE-2026-73241` · CVE record: FreeRDP FreeRDP · CVSS 8.3 High · Not analysed yet · Published 11 Aug 2026 · Tags: Authentication bypass
- [FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel](https://agentprime.io/advisories/CVE-2026-68580.md)
  `CVE-2026-68580` · CVE record: FreeRDP FreeRDP · CVSS 7.7 High · Not analysed yet · Published 2 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read](https://agentprime.io/advisories/CVE-2026-68579.md)
  `CVE-2026-68579` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 2 Aug 2026 · Tags: Memory corruption
- [FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow](https://agentprime.io/advisories/CVE-2026-67298.md)
  `CVE-2026-67298` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD](https://agentprime.io/advisories/CVE-2026-67291.md)
  `CVE-2026-67291` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Use-After-Free via async message proxy](https://agentprime.io/advisories/CVE-2026-67300.md)
  `CVE-2026-67300` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message](https://agentprime.io/advisories/CVE-2026-67299.md)
  `CVE-2026-67299` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Denial of Service via smartcard cache](https://agentprime.io/advisories/CVE-2026-67288.md)
  `CVE-2026-67288` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Denial of Service via serial DeviceControl](https://agentprime.io/advisories/CVE-2026-67303.md)
  `CVE-2026-67303` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [FreeRDP before 3.29.0 Path Traversal via drive redirection](https://agentprime.io/advisories/CVE-2026-67295.md)
  `CVE-2026-67295` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Path traversal
- [FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure](https://agentprime.io/advisories/CVE-2026-67292.md)
  `CVE-2026-67292` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-130
- [FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264](https://agentprime.io/advisories/CVE-2026-66401.md)
  `CVE-2026-66401` · CVE record: FreeRDP FreeRDP · CVSS 2.4 Low · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service](https://agentprime.io/advisories/CVE-2026-67302.md)
  `CVE-2026-67302` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE](https://agentprime.io/advisories/CVE-2026-67306.md)
  `CVE-2026-67306` · CVE record: FreeRDP FreeRDP · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection](https://agentprime.io/advisories/CVE-2026-67289.md)
  `CVE-2026-67289` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Other injection
- [FreeRDP before 3.29.0 TLS Certificate EKU Bypass](https://agentprime.io/advisories/CVE-2026-67294.md)
  `CVE-2026-67294` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Weak cryptography or TLS
- [FreeRDP before 3.29.0 Denial of Service via RDPEI PDU](https://agentprime.io/advisories/CVE-2026-67296.md)
  `CVE-2026-67296` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-20
- [FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup](https://agentprime.io/advisories/CVE-2026-67304.md)
  `CVE-2026-67304` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass](https://agentprime.io/advisories/CVE-2026-66402.md)
  `CVE-2026-66402` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Weak cryptography or TLS
- [FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response](https://agentprime.io/advisories/CVE-2026-67297.md)
  `CVE-2026-67297` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy](https://agentprime.io/advisories/CVE-2026-67301.md)
  `CVE-2026-67301` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Improper Certificate Hostname Validation](https://agentprime.io/advisories/CVE-2026-67293.md)
  `CVE-2026-67293` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Weak cryptography or TLS
- [FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr](https://agentprime.io/advisories/CVE-2026-67305.md)
  `CVE-2026-67305` · CVE record: FreeRDP FreeRDP · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF](https://agentprime.io/advisories/CVE-2026-67290.md)
  `CVE-2026-67290` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption
- [FreeRDP RDP File Parser Remote Code Execution via CLI Options](https://agentprime.io/advisories/CVE-2026-64624.md)
  `CVE-2026-64624` · CVE record: FreeRDP FreeRDP · CVSS 8.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Command injection
- [FreeRDP before 3.28.0 Double-Free via selectedmonitors](https://agentprime.io/advisories/CVE-2026-64621.md)
  `CVE-2026-64621` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common](https://agentprime.io/advisories/CVE-2026-64620.md)
  `CVE-2026-64620` · CVE record: FreeRDP FreeRDP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing](https://agentprime.io/advisories/CVE-2026-57156.md)
  `CVE-2026-57156` · CVE record: FreeRDP FreeRDP · CVSS 8.6 High · Not analysed yet · Published 10 Jul 2026 · Tags: Memory corruption
- [Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName](https://agentprime.io/advisories/CVE-2026-57157.md)
  `CVE-2026-57157` · CVE record: FreeRDP FreeRDP · CVSS 6.5 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Memory corruption
- [FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530](https://agentprime.io/advisories/CVE-2026-57158.md)
  `CVE-2026-57158` · CVE record: FreeRDP FreeRDP · CVSS 5.1 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Memory corruption
- [FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode](https://agentprime.io/advisories/CVE-2026-55827.md)
  `CVE-2026-55827` · CVE record: FreeRDP FreeRDP · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Memory corruption
- [FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback](https://agentprime.io/advisories/CVE-2026-56297.md)
  `CVE-2026-56297` · CVE record: FreeRDP FreeRDP · CVSS 8.3 High · Not analysed yet · Published 8 Jul 2026 · Tags: Race condition
- [Heap-buffer-overflow write in planar bitmap decoder](https://agentprime.io/advisories/CVE-2026-45700.md)
  `CVE-2026-45700` · CVE record: FreeRDP FreeRDP · CVSS 7.7 High · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption
- [FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS](https://agentprime.io/advisories/CVE-2026-44420.md)
  `CVE-2026-44420` · CVE record: FreeRDP FreeRDP · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption
- [FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion](https://agentprime.io/advisories/CVE-2026-44422.md)
  `CVE-2026-44422` · CVE record: FreeRDP FreeRDP · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption
- [FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass](https://agentprime.io/advisories/CVE-2026-44421.md)
  `CVE-2026-44421` · CVE record: FreeRDP FreeRDP · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption
- [FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass](https://agentprime.io/advisories/CVE-2026-40033.md)
  `CVE-2026-40033` · CVE record: FreeRDP FreeRDP · CVSS 8.6 High · Not analysed yet · Published 26 May 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/freerdp.md>
Older: <https://agentprime.io/advisories/technology/freerdp.md?cursor=WyIyMDI2LTA1LTI2VDE0OjA4OjQ3LjUzNTAwMFoiLCJDVkUtMjAyNi00MDAzMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=freerdp&cursor=WyIyMDI2LTA5LTE1VDE1OjE4OjExLjk0MTAwMFoiLCJDVkUtMjAyNi05MTk1NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/freerdp/?cursor=WyIyMDI2LTA5LTE1VDE1OjE4OjExLjk0MTAwMFoiLCJDVkUtMjAyNi05MTk1NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.