[ Vendor · 69 CVEs ]
FreeRDP
CVEs affecting FreeRDP published in the last 30 days, plus any FreeRDP CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114046 | 21 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in… | |
| CVE-2026-114047 | 21 Oct 2026 | CVSS 6.8 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS… | |
| CVE-2026-114041 | 21 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character… | |
| CVE-2026-114042 | 21 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when… | |
| CVE-2026-114043 | 21 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer()… | |
| CVE-2026-114044 | 21 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface… | |
| CVE-2026-114045 | 21 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in… | |
| CVE-2026-111881 | 17 Oct 2026 | CVSS 7.6 | FreeRDPFreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to… | |
| CVE-2026-111880 | 17 Oct 2026 | CVSS 7.4 | FreeRDPFreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC… | |
| CVE-2026-111380 | 16 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue… | |
| CVE-2026-111381 | 16 Oct 2026 | CVSS 7.3 | FreeRDPFreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap… | |
| CVE-2026-111382 | 16 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows… | |
| CVE-2026-111373 | 16 Oct 2026 | CVSS 7.5 | FreeRDPFreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients… | |
| CVE-2026-111374 | 16 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request… | |
| CVE-2026-111375 | 16 Oct 2026 | CVSS 9.1 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger… | |
| CVE-2026-111376 | 16 Oct 2026 | CVSS 5.0 | FreeRDPFreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious… | |
| CVE-2026-111377 | 16 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment… | |
| CVE-2026-111378 | 16 Oct 2026 | CVSS 7.5 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated… | |
| CVE-2026-111379 | 16 Oct 2026 | CVSS 7.3 | FreeRDPFreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory… | |
| CVE-2026-110838 | 14 Oct 2026 | CVSS 7.5 | FreeRDPFreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated… | |
| CVE-2026-110839 | 14 Oct 2026 | CVSS 7.1 | FreeRDPFreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because… | |
| CVE-2026-110832 | 14 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force… | |
| CVE-2026-110833 | 14 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy… | |
| CVE-2026-110834 | 14 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending… | |
| CVE-2026-110835 | 14 Oct 2026 | CVSS 4.0 | FreeRDPFreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is… | |
| CVE-2026-110836 | 14 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU… | |
| CVE-2026-110837 | 14 Oct 2026 | CVSS 7.1 | FreeRDPFreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because… | |
| CVE-2026-110829 | 14 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without… | |
| CVE-2026-110830 | 14 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors… | |
| CVE-2026-110831 | 14 Oct 2026 | CVSS 4.3 | FreeRDPFreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the… | |
| CVE-2026-109953 | 13 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress… | |
| CVE-2026-109948 | 13 Oct 2026 | CVSS 4.3 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP… | |
| CVE-2026-109949 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which… | |
| CVE-2026-109950 | 13 Oct 2026 | CVSS 4.3 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending… | |
| CVE-2026-109951 | 13 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel… | |
| CVE-2026-109952 | 13 Oct 2026 | CVSS 5.3 | FreeRDPThe FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in… | |
| CVE-2026-109941 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by… | |
| CVE-2026-109942 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because… | |
| CVE-2026-109943 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or… | |
| CVE-2026-109944 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so… | |
| CVE-2026-109945 | 13 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT… | |
| CVE-2026-109946 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an… | |
| CVE-2026-109947 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client… | |
| CVE-2026-109678 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated… | |
| CVE-2026-109679 | 13 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body… | |
| CVE-2026-109680 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while… | |
| CVE-2026-109938 | 13 Oct 2026 | CVSS 6.5 | FreeRDPPositive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the… | |
| CVE-2026-109939 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses… | |
| CVE-2026-109940 | 13 Oct 2026 | CVSS 4.3 | FreeRDPFreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11… | |
| CVE-2026-109676 | 13 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed… | |
| CVE-2026-109677 | 13 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr… | |
| CVE-2026-109256 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc… | |
| CVE-2026-109257 | 12 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial… | |
| CVE-2026-109249 | 12 Oct 2026 | CVSS 5.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor… | |
| CVE-2026-109250 | 12 Oct 2026 | CVSS 6.6 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed… | |
| CVE-2026-109251 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit… | |
| CVE-2026-109252 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash… | |
| CVE-2026-109253 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before… | |
| CVE-2026-109254 | 12 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and… | |
| CVE-2026-109255 | 12 Oct 2026 | CVSS 6.8 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger… | |
| CVE-2026-109242 | 12 Oct 2026 | CVSS 7.1 | FreeRDPFreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is… | |
| CVE-2026-109243 | 12 Oct 2026 | CVSS 4.4 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by… | |
| CVE-2026-109244 | 12 Oct 2026 | CVSS 6.6 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without… | |
| CVE-2026-109245 | 12 Oct 2026 | CVSS 6.8 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that… | |
| CVE-2026-109246 | 12 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge… | |
| CVE-2026-109247 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c… | |
| CVE-2026-109248 | 12 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a… | |
| CVE-2026-109240 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by… | |
| CVE-2026-109241 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to… |