Skip to main content

FreeRDP CVE-2026-67290

| EUVDEUVD-2026-51865 HIGH
Out-of-bounds Read (CWE-125)
2026-08-01 VulnCheck GHSA-v8g5-qxq2-3959
Buffer Overflow Information Disclosure Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Exploitation requires user-initiated connection to a malicious server (UI:R); heap out-of-bounds read may expose memory content (C:L); crash is the confirmed primary impact (A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:09 vuln.today
Analysis Generated
Aug 01, 2026 - 13:09 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.

AnalysisAI

Heap out-of-bounds read in FreeRDP's TSMF FFmpeg decoder allows a malicious RDP server to crash connecting client processes by sending malformed AVC1 MPEG2VIDEOINFO media type data with undersized ExtraData buffers. All FreeRDP releases prior to 3.29.0 are affected (CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*), with the root cause being fixed-offset heap reads in the media format parser that proceed without validating source buffer length - a CWE-125 pattern. No CISA KEV listing or public exploit code has been identified at time of analysis; the vendor has released a patch at version 3.29.0 and the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity consequence per the provided vector.

Technical ContextAI

The vulnerable component is the TSMF (Terminal Services Multimedia Framework) virtual channel within FreeRDP's FFmpeg-based decoder, responsible for multimedia format negotiation during RDP sessions. When the decoder processes an AVC1-typed MPEG2VIDEOINFO media format descriptor, it reads at fixed byte offsets into the ExtraData field without first asserting that the source buffer is long enough to satisfy those reads - the textbook CWE-125 (Out-of-bounds Read) root cause. The affected CPE is cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* covering all versions from the earliest release through pre-3.29.0. The patch commit 8d3b86022f0d71aefa7bd2e466d2d391693a41b3 introduces systematic bounds-checking hardening across multiple FreeRDP protocol channels - RAIL PDU headers (adding RAIL_PDU_MAX_LENGTH=65535), RDPEI touch-input PDUs (adding RDPINPUT_MAX_PDU_LENGTH), and the HTTP gateway response reader - suggesting a broad audit of untrusted-length parsing was undertaken alongside the TSMF fix. Notably, the diff provided does not show changes to TSMF or FFmpeg source files directly, which may indicate those changes are in additional files not included in the diff excerpt.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which incorporates the fix commit 8d3b86022f0d71aefa7bd2e466d2d391693a41b3 and addresses bounds-validation deficiencies across multiple protocol channels. The vendor security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8 is the authoritative source for patch guidance. If immediate upgrade is not feasible, consider disabling TSMF multimedia redirection at the client policy or configuration level to remove the vulnerable decoder code path from the attack surface - this prevents multimedia streaming in RDP sessions as a trade-off. Additionally, restricting FreeRDP client connections via network policy to only known-trusted, internally managed RDP servers eliminates the server-side attack vector entirely for the affected client population. No patch version beyond 3.29.0 is specified in source data; confirm availability of 3.29.0 packages from your distribution or build source before deployment.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy