Skip to main content

FreeRDP EUVDEUVD-2026-51844

| CVE-2026-67296 HIGH
Improper Input Validation (CWE-20)
2026-08-01 VulnCheck GHSA-xq3v-xj62-r99v
Denial Of Service Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network-reachable DoS with no confidentiality or integrity impact; scope unchanged as only the FreeRDP server process is affected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 01, 2026 - 13:10 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

AnalysisAI

Denial of service in FreeRDP before 3.29.0 allows any unauthenticated network-reachable RDP client to exhaust server memory by sending a crafted RDPEI PDU with a large declared body length and no corresponding body data. The RDPEI server channel handler allocates a stream buffer sized to the attacker-controlled length field without first validating it against any maximum, making exploitation trivially repeatable. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the unauthenticated pre-auth vector (CVSS 4.0 PR:N, AV:N, AC:L) and 8.7 score indicate meaningful priority for deployments running FreeRDP in server mode.

Technical ContextAI

FreeRDP is an open-source implementation of Microsoft's Remote Desktop Protocol used as both a client and server library. The affected component is the RDPEI (Remote Desktop Protocol: Extended Input) virtual channel, which handles touch and stylus input virtualization messages. CWE-20 (Improper Input Validation) identifies the root cause: the server-side channel handler reads the declared PDU body length from an attacker-controlled message header and passes it directly to the stream allocation routine without enforcing any upper bound. This class of input validation failure is structurally identical to allocation-of-resources-without-limits patterns. Per CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*, every FreeRDP release from version 0 through the last release before 3.29.0 carries this flaw in the server-side RDPEI handler.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which contains the vendor-released patch as documented in https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jm8r-22j6-4m4v. If immediate upgrade is not possible and FreeRDP is exposed in server mode, restrict inbound RDP (TCP 3389 or the configured port) to a known allowlist of trusted client IP addresses via host firewall or network ACL - this reduces exposure but does not eliminate the vulnerability and may be operationally disruptive if clients are dynamic. Alternatively, disabling the RDPEI virtual channel server-side (if touch and pen input virtualization is not required) removes the vulnerable code path entirely without requiring a version upgrade, though the exact configuration mechanism depends on how the FreeRDP server API is integrated into the host application. Organizations running FreeRDP in client-only mode require no remediation for this specific CVE.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-51844 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy