Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Heap buffer overflow in FreeRDP Windows client clipboard virtual channel (CVE-2026-67305)
A heap buffer overflow exists in the FreeRDP Windows client (wfreerdp) when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs on the clipboard static virtual channel. A malicious RDP server can respond to a client file c...
Fixed in 3.29.0
Certificate purpose bypass in FreeRDP server TLS authentication (CVE-2026-67294)
FreeRDP's client-side TLS certificate verification improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during server authentication. In `x509_utils_verify()`, if server-purpose verificati...
Fixed in 3.29.0
Improper wildcard certificate hostname validation in FreeRDP (CVE-2026-67293)
FreeRDP's TLS hostname matcher incorrectly accepts wildcard certificates (e.g., *.example.com) for multi-label subdomains (e.g., a.b.example.com), which standard wildcard matching does not permit. This diverges from O...
Fixed in 3.29.0
Buffer over-disclosure and DoS via WebSocket Ping handling in FreeRDP (CVE-2026-67292)
FreeRDP's gateway WebSocket transport mishandles server-sent Ping control frames. A non-empty Ping causes the client to reply with an overlong Pong disclosing up to 1024 bytes of buffer contents beyond the received pa...
Fixed in 3.29.0
HTTP proxy CONNECT injection in FreeRDP via RDP redirection TargetNetAddress (CVE-2026-67289)
FreeRDP does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and written directly into the HTTP proxy CON...
Fixed in 3.29.0
TLS certificate identity validation bypass in FreeRDP (CVE-2026-66402)
FreeRDP performs custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity validation APIs, introducing three distinct weaknesses in server identity verification: DNS SAN values are tru...
Fixed in 3.29.0