Advisories · Technology

FreeRDP.

Every CVE that names FreeRDP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-40254 CVE record

CVSS 4.2 Medium

FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..
- FreeRDP
- CWE-193
Not analysed yet 24 Apr 2026
CVE-2026-33995 CVE record

CVSS 5.3 Medium

FreeRDP: Possible double free in kerberos_AcceptSecurityContext
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33987 CVE record

CVSS 7.1 High

FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33986 CVE record

CVSS 7.5 High

FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33985 CVE record

CVSS 5.9 Medium

FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33984 CVE record

CVSS 7.5 High

FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33983 CVE record

CVSS 6.5 Medium

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS
- FreeRDP
- Memory corruption
- CWE-252
Not analysed yet 30 Mar 2026
CVE-2026-33982 CVE record

CVSS 7.1 High

FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read
- FreeRDP
- Memory corruption
Not analysed yet 30 Mar 2026
CVE-2026-33952 CVE record

CVSS 6.0 Medium

FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks
- FreeRDP
- Denial of service
Not analysed yet 30 Mar 2026
CVE-2026-33977 CVE record

CVSS 6.9 Medium

FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)
- FreeRDP
- Denial of service
Not analysed yet 30 Mar 2026
CVE-2026-31897 CVE record

CVSS 0.0 None

FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-31806 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-31885 CVE record

CVSS 6.5 Medium

FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-31884 CVE record

CVSS 6.5 Medium

FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
- FreeRDP
- Denial of service
Not analysed yet 13 Mar 2026
CVE-2026-31883 CVE record

CVSS 6.5 Medium

FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-29776 CVE record

CVSS 3.1 Low

FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library
- FreeRDP
- Memory corruption
- Denial of service
Not analysed yet 13 Mar 2026
CVE-2026-29775 CVE record

CVSS 5.3 Medium

FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-29774 CVE record

CVSS 5.3 Medium

FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects
- FreeRDP
- Memory corruption
Not analysed yet 13 Mar 2026
CVE-2026-27951 CVE record

CVSS 5.3 Medium

FreeRDP has possible Integer overflow in Stream_EnsureCapacity
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-27950 CVE record

CVSS 5.5 Medium

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-26986 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in rail_window_free
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-26965 CVE record

CVSS 8.8 High

FreeRDP has Out-of-bounds Write
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-26955 CVE record

CVSS 8.8 High

FreeRDP has Out-of-bounds Write
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-27015 CVE record

CVSS 5.0 Medium

FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)
- FreeRDP
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2026-26271 CVE record

CVSS 5.5 Medium

Buffer Overread in FreeRDP Icon Processing
- FreeRDP
- CWE-126
Not analysed yet 25 Feb 2026
CVE-2026-25997 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_clipboard_format_equal
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25959 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25955 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25954 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_rail_server_local_move_size
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25953 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25952 CVE record

CVSS 5.5 Medium

FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25942 CVE record

CVSS 5.5 Medium

FreeRDP has global-buffer-overflow in xf_rail_server_execute_result
- FreeRDP
- Memory corruption
Not analysed yet 25 Feb 2026
CVE-2026-25941 CVE record

CVSS 4.3 Medium

FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read
- FreeRDP
- Memory corruption
- CWE-20
Not analysed yet 25 Feb 2026
CVE-2026-24684 CVE record

CVSS 8.7 High

FreeRDP has a Heap-use-after-free in play_thread
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24683 CVE record

CVSS 8.7 High

FreeRDP has a heap-use-after-free in ainput_send_input_event
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24682 CVE record

CVSS 8.7 High

FreeRDP has a Heap-buffer-overflow in audio_formats_free
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24681 CVE record

CVSS 8.7 High

FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24680 CVE record

CVSS 8.7 High

FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24679 CVE record

CVSS 8.7 High

FreeRDP has a heap-buffer-overflow in urb_select_interface
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24678 CVE record

CVSS 8.7 High

FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24677 CVE record

CVSS 8.7 High

FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24676 CVE record

CVSS 7.7 High

FreeRDP has a heap-use-after-free in audio_format_compatible
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24675 CVE record

CVSS 7.7 High

FreeRDP has a Heap-use-after-free in urb_select_interface
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-24491 CVE record

CVSS 7.7 High

FreeRDP has a heap-use-after-free in video_timer
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-23948 CVE record

CVSS 6.9 Medium

FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()
- FreeRDP
- Memory corruption
Not analysed yet 9 Feb 2026
CVE-2026-23884 CVE record

CVSS 7.7 High

Heap-use-after-free in gdi_set_bounds
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23883 CVE record

CVSS 7.7 High

Heap-use-after-free in update_pointer_new
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23732 CVE record

CVSS 5.5 Medium

FreeRDP has heap-buffer-overflow in Glyph_Alloc
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23534 CVE record

CVSS 7.7 High

FreeRDP has heap-buffer-overflow in clear_decompress_bands_data
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23533 CVE record

CVSS 7.7 High

FreeRDP has heap-buffer-overflow in clear_decompress_residual_data
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23532 CVE record

CVSS 7.7 High

FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23531 CVE record

CVSS 7.7 High

FreeRDP has heap-buffer-overflow in clear_decompress
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-23530 CVE record

CVSS 7.7 High

FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle
- FreeRDP
- Memory corruption
Not analysed yet 19 Jan 2026
CVE-2026-22859 CVE record

CVSS 5.6 Medium

FreeRDP has a heap-buffer-overflow in urb_select_configuration
- FreeRDP
- Memory corruption
- CWE-129
Not analysed yet 14 Jan 2026
CVE-2026-22858 CVE record

CVSS 5.6 Medium

FreeRDP has a global-buffer-overflow in crypto_base64_decode
- FreeRDP
- Memory corruption
- CWE-758
Not analysed yet 14 Jan 2026
CVE-2026-22857 CVE record

CVSS 6.8 Medium

FreeRDP has a heap-use-after-free in irp_thread_func
- FreeRDP
- Memory corruption
Not analysed yet 14 Jan 2026
CVE-2026-22856 CVE record

CVSS 6.8 Medium

FreeRDP has a heap-use-after-free in create_irp_thread
- FreeRDP
- Race condition
- Memory corruption
Not analysed yet 14 Jan 2026
CVE-2026-22855 CVE record

CVSS 5.6 Medium

FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call
- FreeRDP
- Memory corruption
Not analysed yet 14 Jan 2026
CVE-2026-22854 CVE record

CVSS 6.8 Medium

FreeRDP has a heap-buffer-overflow in drive_process_irp_read
- FreeRDP
- Memory corruption
Not analysed yet 14 Jan 2026
CVE-2026-22853 CVE record

CVSS 6.8 Medium

FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array
- FreeRDP
- Memory corruption
Not analysed yet 14 Jan 2026