Advisories · Technology
FreeRDP.
Every CVE that names FreeRDP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions
- FreeRDP
- Denial of service
- CVSS 7.1 High
FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec
- FreeRDP
- Memory corruption
- CVSS 7.1 High
FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
- FreeRDP
- Memory corruption
- CVSS 7.1 High
FreeRDP before 3.31.0 Denial of Service via pool_decode_rect
- FreeRDP
- Denial of service
- CVSS 7.1 High
FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
- FreeRDP
- Denial of service
- CVSS 7.1 High
FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
- FreeRDP
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
- FreeRDP
- CWE-693
- CVSS 7.7 High
FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
- FreeRDP
- Memory corruption
- CVSS 7.7 High
FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC
- FreeRDP
- Race condition
- CVSS 7.1 High
FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
- FreeRDP
- Memory corruption
- CVSS 7.1 High
FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR
- FreeRDP
- Memory corruption
- CVSS 5.3 Medium
FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
- FreeRDP
- Memory corruption
- CVSS 7.1 High
FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
- FreeRDP
- Memory corruption
- CVSS 7.7 High
FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
- FreeRDP
- Memory corruption
- CVSS 7.1 High
FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU
- FreeRDP
- Memory corruption
- CVSS 6.5 Medium
FreeRDP: Denial of service through ADPCM frame size calculation
- FreeRDP
- Denial of service
- CVSS 7.2 High
FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
- FreeRDP
- Memory corruption
- CVSS 6.1 Medium
FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag
- FreeRDP
- Memory corruption
- CVSS 5.4 Medium
FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
- FreeRDP
- Memory corruption
- CWE-193
- CVSS 8.7 High
FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
- FreeRDP
- Memory corruption
- CVSS 8.3 High
FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
- FreeRDP
- Memory corruption
- CVSS 8.3 High
FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)
- FreeRDP
- Authentication bypass
- CVSS 7.7 High
FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.29.0 Use-After-Free via async message proxy
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.29.0 Denial of Service via smartcard cache
- FreeRDP
- Memory corruption
- CVSS 5.3 Medium
FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
- FreeRDP
- Denial of service
- CVSS 5.3 Medium
FreeRDP before 3.29.0 Path Traversal via drive redirection
- FreeRDP
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure
- FreeRDP
- CWE-130
- CVSS 2.4 Low
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
- FreeRDP
- Memory corruption
- CVSS 5.3 Medium
FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
- FreeRDP
- Denial of service
- CVSS 5.3 Medium
FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE
- FreeRDP
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
- FreeRDP
- Other injection
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.29.0 TLS Certificate EKU Bypass
- FreeRDP
- Weak cryptography or TLS
- CVSS 8.7 High
FreeRDP before 3.29.0 Denial of Service via RDPEI PDU
- FreeRDP
- CWE-20
- CVSS 8.7 High
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
- FreeRDP
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- FreeRDP
- Weak cryptography or TLS
- CVSS 8.7 High
FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
- FreeRDP
- Denial of service
- CVSS 8.7 High
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
- FreeRDP
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.29.0 Improper Certificate Hostname Validation
- FreeRDP
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- FreeRDP
- Memory corruption
- CVSS 8.7 High
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF
- FreeRDP
- Memory corruption
- CVSS 8.5 High
FreeRDP RDP File Parser Remote Code Execution via CLI Options
- FreeRDP
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.28.0 Double-Free via selectedmonitors
- FreeRDP
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common
- FreeRDP
- Memory corruption
- CVSS 8.6 High
FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing
- FreeRDP
- Memory corruption
- CVSS 6.5 Medium
Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName
- FreeRDP
- Memory corruption
- CVSS 5.1 Medium
FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530
- FreeRDP
- Memory corruption
- CVSS 7.5 High
FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode
- FreeRDP
- Memory corruption
- CVSS 8.3 High
FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback
- FreeRDP
- Race condition
- CVSS 7.7 High
Heap-buffer-overflow write in planar bitmap decoder
- FreeRDP
- Memory corruption
- CVSS 8.8 High
FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
- FreeRDP
- Memory corruption
- CVSS 7.5 High
FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion
- FreeRDP
- Memory corruption
- CVSS 8.8 High
FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass
- FreeRDP
- Memory corruption
- CVSS 8.6 High
FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass
- FreeRDP
- Memory corruption