Skip to main content

FreeRDP EUVDEUVD-2026-51824

| CVE-2026-67298 HIGH
Integer Underflow (CWE-191)
2026-08-01 VulnCheck GHSA-wrfm-6x9r-42cr
Integer Overflow Buffer Overflow Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable RDP server, no authentication required per CVSS 4.0 PR:N; impact is process crash only, with no confidentiality or integrity effect described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:12 vuln.today
Analysis Generated
Aug 01, 2026 - 13:12 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

AnalysisAI

Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.

Technical ContextAI

FreeRDP (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) is the dominant open-source implementation of the Remote Desktop Protocol, used extensively in Linux environments and remote-desktop infrastructure. The vulnerability resides in the server-side RAIL (Remote Application Integrated Locally) virtual channel, which supports RemoteApp seamless window functionality. The root cause is CWE-191 (Integer Underflow / Wraparound): the code performs size = orderLength - RAIL_PDU_HEADER_LENGTH using unsigned arithmetic without a prior bounds check that orderLength is at least RAIL_PDU_HEADER_LENGTH (4 bytes). When a client sends orderLength of 0-3, the result wraps to a value near UINT32_MAX. The subsequent Stream_EnsureRemainingCapacity() call fails to detect the oversized request because stream pointer arithmetic also wraps, and WTSVirtualChannelRead() then attempts to read that enormous length into a normally-sized heap buffer, producing an out-of-bounds write. The flaw is in channels/rail/server/rail_main.c and affects all FreeRDP releases through 3.28.0, as confirmed by EUVD-2026-51824 and the GitHub security advisory GHSA-qmvw-52ph-q5pv.

RemediationAI

Upgrade to FreeRDP 3.29.0, which contains the fix across two commits: https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f and https://github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eefb5e85d64a9b8. The vendor security advisory is at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-q5pv and the VulnCheck advisory is at https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-rail-orderlength-underflow. For deployments where immediate upgrade is not feasible, disable the RAIL (RemoteApp) virtual channel on the FreeRDP server if RemoteApp functionality is not operationally required - this eliminates the vulnerable code path entirely, though it removes RemoteApp/seamless window support. Alternatively, restrict RDP server access to trusted client IP ranges via firewall rules on TCP 3389 to limit exposure to untrusted clients, accepting the trade-off that this does not eliminate the vulnerability but reduces the attack surface.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

EUVD-2026-51824 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy