Skip to main content

FreeRDP CVE-2026-68580

| EUVDEUVD-2026-51990 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-08-02 VulnCheck GHSA-mj63-24h6-p8wq
Buffer Overflow Denial Of Service Heap Overflow Freerdp
7.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

AV:N because the server sends the malicious parameter over the network; AC:H for audio redirection prerequisite and attacker-controlled server requirement; PR:N as the attacker controls the server; UI:R for user-initiated connection; S:U as impact is confined to the client process; C/I/A:H for worst-case heap overflow on ALSA.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 02, 2026 - 13:05 vuln.today
Patch available
Aug 02, 2026 - 13:01 EUVD
CVE Published
Aug 02, 2026 - 12:15 cve.org
HIGH 7.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.

AnalysisAI

Integer overflow in FreeRDP's audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends affects all versions before 3.29.0, exploitable by a malicious or compromised RDP server. The server can supply a crafted FramesPerPacket value that causes allocation size wraparound, leading to a heap-based buffer overflow on Linux/ALSA - potentially enabling code execution - or denial of service on all supported platforms. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; vendor-released patch (3.29.0) is available.

Technical ContextAI

FreeRDP is a widely-used open-source RDP client library (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) that implements the Microsoft Remote Desktop Protocol. The audin virtual channel handles audio input (microphone) redirection from client to server, receiving configuration parameters - including FramesPerPacket - from the connected RDP server during channel negotiation. The root cause is CWE-122 (Heap-based Buffer Overflow): the FramesPerPacket value is used in an arithmetic expression to compute buffer allocation size without adequate bounds checking, causing an integer wraparound that produces a dramatically undersized heap allocation. Subsequent audio data writes then overflow this allocation. The flaw spans four backends: ALSA (Linux), sndio (OpenBSD), WinMM (Windows), and OpenSL ES (Android), with heap overflow achievable on ALSA and denial of service on the remaining three. Because the vulnerable parameter originates from the server side of the RDP connection, any attacker who controls or compromises an RDP server can trigger this on connecting clients.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which addresses the integer overflow by adding proper validation of the server-supplied FramesPerPacket parameter across all affected audio backends. The vendor advisory confirming this fix is at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x. If immediate upgrade is not feasible, disable the audio input redirection (audin) virtual channel entirely - this eliminates the vulnerable attack surface at the cost of losing microphone and audio input functionality during RDP sessions. In FreeRDP, this means omitting the /microphone or equivalent audio-input flags when launching sessions. Additionally, organizations should restrict FreeRDP client connections to explicitly trusted, internally managed RDP servers and block connections to external or unknown servers via firewall or VPN policy, which prevents the server-controlled attack vector from reaching clients. No earlier patch version is independently confirmed to address this specific vulnerability.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-68580 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy