Freerdp
Monthly
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Unauthenticated keyboard injection in the FreeRDP shadow server (versions 3.0.0 through 3.31.x) allows remote attackers to send synthetic keystrokes into a host user's X11 session via XTEST by delivering an input PDU during the Confirm Active state, before any authentication takes place. Exploitation requires the shadow/mirroring server to be network-reachable and the host to be running an X11 session over a TLS-only RDP negotiation; the confirmed impact is integrity-only (fabricated input) with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
Unbounded heap accumulation in the FreeRDP proxy (the pf/proxy relay component) lets unauthenticated remote attackers exhaust proxy memory by streaming RDPDR device-redirection fragments that begin with a FIRST fragment but never carry a LAST fragment, so reassembly state grows in proportion to bytes sent. Affected deployments are FreeRDP 3.0.0-beta1 through versions before 3.32.0 that run the proxy with the RDPDR channel reachable from untrusted clients; plain FreeRDP client or server deployments are not the stated target. Rated CVSS 4.0 8.2 (High), with assessed CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, this is a slow-burn memory-exhaustion DoS requiring sustained fragment traffic rather than a single packet, and there is no public exploit identified at time of analysis.
Authenticated RDP clients can force unbounded server-side memory allocation in FreeRDP 2.0.0 through 3.31.x by sending a seven-byte DATA_FIRST message on an already-opened dynamic virtual channel (DVC) that declares a large 32-bit length, driving zeroed resident-memory growth until the server's resources are exhausted and service is denied. The flaw is availability-only (CWE-400 resource exhaustion; CVSS 4.0 base 7.1, assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure impact, and every action requires a valid authenticated session plus a successfully opened DVC - so real exposure depends on who can authenticate to the RDP service, and it is not remotely exploitable without credentials. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
Memory exhaustion denial of service in FreeRDP 3.20.1 up to but not including 3.32.0 lets a malicious or compromised RDP server crash connecting clients by abusing drive redirection read requests. Per the CVSS v4 vector (PR:N, UI:P), the attack is remote and the client side of the protocol is unauthenticated, but exploitation is conditional: the victim must be induced to initiate an RDP session to the attacker-controlled server and must have drive redirection (rdpdr) active for the server to issue the offending IRP_MJ_READ requests. Impact is confined to availability (client memory exhaustion and crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Denial of service in FreeRDP client versions 3.11.0 through 3.31.x allows a malicious or compromised RDP server to abort a connected client process: once the RDPGFX graphics channel negotiates the AVC444 or AVC444v2 codec, the server can send an otherwise in-bounds region rectangle with an odd width, which bypasses the missing even-width validation before YUV444 conversion and trips a CWE-617 reachable assertion. Per the CVSS vector (PR:N, UI:P), the attack requires no authentication on the client side, but the victim must initiate or accept the connection to the hostile server, and the resulting impact is confined to availability of that single client process - no confidentiality or integrity loss and no code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so real-world risk is moderate and bounded by the requirement that the attacker controls the RDP server side.
Denial of service in the FreeRDP RDP client (versions 3.0.0 through 3.31.x) allows a malicious or compromised RDP server to crash a connecting client that has both smartcard emulation and smartcard redirection enabled: the server releases a smartcard-emulation context, establishes a new one, then issues SCardTransmit with the stale card handle, causing the client to look up the deleted parent context and hit a terminating WINPR_ASSERT. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) confirms this is network-reachable and unauthenticated, but it requires the victim to actively initiate a connection outward to the hostile server, and the impact is availability-only (client process abort, no code execution or data disclosure). No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation also depends on the non-default smartcard emulation/redirection feature set being enabled.
Denial of service in FreeRDP clients: versions 3.29.0 through 3.31.x contain a double free (CWE-415) in the async-update message proxy that a malicious or compromised RDP server can trigger by sending a point-bearing PolygonSC or PolygonCB order followed by a second polygon order with numPoints set to zero, crashing the connecting client. Exploitation requires the victim to connect to an attacker-controlled server and to have launched the client with the non-default +async-update option, so default client configurations are not exposed; user interaction is needed to initiate the connection, and impact is limited to availability with no code execution, data disclosure, or integrity loss. There is no confirmation of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; the observed CVSS 4.0 score of 7.1 is driven by the availability impact.
NULL pointer dereference in FreeRDP's Remote Desktop Gateway (RDG) transport path affects client builds from 2.3.0 up to (but not including) 3.32.0, allowing an attacker who controls or has compromised the RD Gateway to crash a connecting client. The malicious gateway only needs to return an eight-byte, header-only PKT_TYPE_CLOSE_CHANNEL control packet; rdg_process_control_packet forwards the absent payload to rdg_process_close_packet without a NULL check, and the client dereferences it. The attacker must already occupy the gateway position (not an arbitrary remote host) and the user must initiate the outbound RDP session, so this is a bounded, availability-only denial of service - CVSS v4.0 base 7.1, with the independent assessment scoring it AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the gateway-position prerequisite constrains realistic abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
FreeRDP clients running versions 3.27.1 through 3.31.x with the non-default Bitmap Cache V3 feature enabled can be crashed by a malicious or compromised RDP server that sends a crafted Cache Bitmap V3 order during connection setup. The NULL pointer dereference occurs because the client bitmap cache is accessed before it is initialized when the CBR3_DO_NOT_CACHE flag is set, leading to a denial-of-service (availability impact only, no confidentiality or integrity loss). Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server and have enabled the Bitmap Cache V3 codec via /cache:codec:<rfx|nsc|jpeg>; default configurations are not affected, and no public exploit code has been identified at time of analysis.
A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.
A reachable assertion in the FreeRDP client (3.0.0-beta1 through versions prior to 3.32.0) allows a malicious RDP server to crash a connecting client. When the client is built with verbose WinPR assertions enabled and is using smartcard emulation, the emulated SCardStatusA handler forwards a NULL reader-name destination to scard_copy_strings; a server that sends an SCardStatusA request with fmszReaderNamesIsNULL=1 triggers that assertion and aborts the client process. Impact is limited to a client-side denial of service against a single connecting session - no code execution, lateral movement, or credential impact - and exploitation demands both non-default build/runtime settings and a victim who initiates a connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided, but the narrow configuration prerequisites keep real-world urgency low despite the 7.1 CVSS 4.0 score.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Use-after-free in FreeRDP's smartcard redirection allows a malicious RDP server to corrupt memory on a connecting client, potentially leading to crashes or code execution. Affected versions are 3.0.0-beta1 through 3.31.x; exploitation requires the victim to connect to an attacker-controlled server with the smartcard channel active, and no public exploit identified at time of analysis.
A malicious RDP client can crash a FreeRDP-based RDP server running versions before 3.32.0 by negotiating the NSCodec and requesting an oversized desktop geometry, which forces a buffer-growth allocation failure inside nsc_context_initialize_encode() and leaves dangling plane pointers that are later double-freed during context teardown. The impact is availability-only - no code execution, data exposure, or persistence - and the attack is unauthenticated (CVSS PR:N), but success depends on actually inducing the allocation failure, so the trigger is not perfectly deterministic and the vulnerable server-mode deployment is less common than FreeRDP's client-side use. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-priority crash issue rather than the more alarming 8.2 CVSS 4.0 base score suggests.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.
A divide-by-zero in FreeRDP's freerdp-shadow-cli shadow server (versions before 3.32.0) allows an authenticated client to crash the process by sending a Frame Acknowledge PDU with a frame id one greater than the last frame sent, disconnecting all viewers. Exploitation requires a valid authenticated session and only affects the non-default shadow server deployment; no user interaction is needed and complexity is low. No public exploit code has been identified at time of analysis, and the impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
FreeRDP 3.0.0 through 3.31.x allows an on-path attacker to capture OAuth authorization codes and substitute the OpenID discovery document during Azure AD authentication because freerdp_http_request() completes TLS handshakes without validating the server certificate chain. Exploitation requires the victim to use the Azure AD/AAD-brokered RDP path (plain RDP is unaffected) and to actively perform the login while the attacker holds a man-in-the-middle network position, making this a conditional risk rather than a broadly exploitable flaw. No public exploit code has been identified at time of analysis, and the issue is patched in FreeRDP 3.32.0.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Heap-based buffer overflow in FreeRDP client versions before 3.31.0 allows a malicious or compromised RDP server to corrupt client memory by sending a Server Redirection PDU whose LoadBalanceInfo field is longer than the fixed 512-byte heap buffer used in nego_send_negotiation_request. Successful exploitation crashes the client and, when chained with a memory-disclosure primitive, could lead to code execution on the connecting workstation. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record, so current exploitation appears opportunistic rather than confirmed in the wild.
FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.
FreeRDP clients before 3.31.0 terminate unexpectedly when connected to a malicious RDP server, because the URBDRC (USB redirection) control-transfer request path forwards an attacker-supplied OutputBufferSize of 65536 to the libusb backend without validating it, hitting a reachable assertion. The attacker must control the RDP server and convince a user to connect, so exploitation is network-facing but user-initiated. Impact is limited to availability (client process crash) rather than code execution or data exposure; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in FreeRDP clients before 3.31.0: a rogue or compromised RD Gateway can send a WebSocket Ping frame with a crafted 64-bit extended payload length that wraps an integer inside WinPR's Stream_EnsureRemainingCapacity, producing a double free that crashes the client while the connection is being established. Exploitation requires no credentials on the attacker's side and only a victim client that routes its session through that gateway over the WebSocket transport; the primary impact is loss of availability of the client session. Vendor-released patches are available in FreeRDP 3.31.0, and there is no public exploit code or active exploitation reported in the supplied intelligence.
Let me synthesize. CVE-2026-91959: FreeRDP buffer over-read in rts_read_result (RPC gateway transport parser), truncated BIND_ACK PDU result entry → OOB read → process abort (DoS). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H — network, no privileges, passive UI (UI:P means user must perform... in CVSS 4.0, UI:P = Passive, meaning the user just needs to interact minimally, like a client connecting), high availability impact only. So no confidentiality/integrity impact despite the "Information Disclosure" tag — actually the tag "Information Disclosure" seems mislabeled since VC:N. Hmm — buffer over-read could disclose memory, but the CVSS says VC:N. The description says process abort (DoS). So the tag "Information Disclosure" is arguably mislabeled — but do I want to emit a data_quality_flag? The tags list: "Buffer Overflow, Information Disclosure, Freerdp". "Buffer Overflow" is arguably wrong too — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag on an over-read is a mislabel... The instructions say only emit a flag when the input metadata is clearly wrong and verifiable. Information Disclosure: an OOB read technically can leak memory, but CVSS says VC:N and description says process abort. I'd say low confidence. Buffer Overflow mislabel — CWE-125 is "Out-of-bounds Read", which is distinct from buffer overflow (CWE-787/CWE-120). Hmm, but many tag taxonomies lump them. I'll emit one flag with medium confidence for "Information Disclosure"? Actually the guidance says flags should be high-confidence and verifiable. Maybe emit a flag for "Buffer Overflow" as mislabeled_tag with suggested "out-of-bounds-read"... but 'suggested' is "the correct/canonical slug if you know it". Hmm. I think I can include one flag with medium confidence. Risk: noise. The instructions say empty array is common and correct. Given CWE-125 ≠ buffer overflow and CVSS shows VC:N (no info disclosure), I think two tags are arguably mislabeled. But
Client-side denial of service in FreeRDP before 3.31.0: the URBDRC (USB redirection) channel's func_get_ep_desc function indexes interface arrays by positional offset instead of the protocol's InterfaceNumber field, so a malicious or compromised RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and trigger an out-of-bounds heap read that crashes the connecting client. The flaw only degrades availability (no confidentiality or integrity impact per the CVSS 4.0 vector), requires the victim to initiate a session against the hostile server, and no public exploit code or active exploitation has been reported at time of analysis. It is a targeted-attacker nuisance rather than a mass-exploitation risk, but patching to 3.31.0 is straightforward.
Remote, unauthenticated attackers can crash any FreeRDP-based RDP server running a version prior to 3.31.0 by sending crafted RDP connection packets that supply zero or oversized DesktopWidth and DesktopHeight values during GCC capability negotiation. The malformed dimensions are used unchecked in multifragment update capability calculations, producing a division-by-zero (CWE-369) or assertion failure that terminates the server process. This is a pure availability impact (CVSS 4.0 base 8.2, VC:N/VI:N/VA:H); no publicly available exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis.
FreeRDP clients before 3.31.0 crash when a malicious RDP server sends a crafted Surface Bits command advertising the NSCodec codec ID — the GDI surface-bits handler dereferences a NULL decoder pointer instead of rejecting the unsupported codec. The victim only has to initiate an RDP session to an attacker-controlled or compromised server; the outcome is a client-side denial of service (application crash), with no memory corruption, code execution, or data exposure reported. No public exploit code and no CISA KEV listing were identified at time of analysis.
FreeRDP versions before 3.31.0 contain a heap buffer overflow in the client-side negotiation routine nego_send_negotiation_request(), which writes the server-supplied LB_LOAD_BALANCE_INFO field into a fixed 512-byte buffer without checking its length. A malicious RDP server — or an attacker positioned as a man-in-the-middle — can trigger the overflow by replying to a client's connection attempt with a Server Redirection PDU carrying an oversized LB_LOAD_BALANCE_INFO value, corrupting heap memory before authentication even completes. The confirmed impact is denial of service or heap corruption (CVSS 7.1, availability-only); no public exploit code and no CISA KEV listing were identified at time of analysis.
Let me write the JSON. Product: FreeRDP. CVE-2026-91952, infinite loop DoS in pool_decode_rect with AVC444 metablocks, client-side vulnerability — malicious RDP server attacks clients. AV:N, AC:L, PR:N, UI:P (UI passive), VA:H only. No KEV, no POC mentioned. CVSS 3.1 assessed: client connects to malicious RDP server. Attack vector network, AC:L? The crafted server response triggers loop — no special conditions besides connecting to malicious server (user interaction passive). PR:N. UI:P. C/I:N, A:H. S:U. So CVSS:3.1/AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H = 6.5? Let's compute: base score for AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H. Exploitability = 8.22 × 1.0 × 0.85 × 0.62 = 8.22*0.85=6.987; *0.62=4.332. Impact = 6.42 × 0.31? A:H → ISCBase = 1 - (1-0)(1-0)(1-0.56) = 0.56. Impact = 6.42 × 0.56 = 3.595. Total = roundup(min(3.595+4.332, 10)) = roundup(7.927) = 7.9. Hmm, that's odd — but that's standard: CVE with A:H and UI:P gives ~7.9? Actually wait, the numbers given in the prompt: 7.1 for CVSS 4.0. Let me just compute 3.1: 7.9? Let me double-check exploitability with UI:P (0.62). Yes 8.22*0.85*0.62 = 4.3319. And impact 3.5952. Sum 7.927 → roundup = 7.9. Hmm that seems high but it's the formula. Actually let me recheck: for A:H, ISCBase = 0.56, Impact sub score = 6.42 × 0.56 = 3.5952. Scope unchanged: Impact = 6.42 × (ISCBase - 0.029) - 3.25×(ISCBase-0.02)^15 = 6.42×0.531 - 3.25×(0.54)^15. (0.54)^15 is tiny → ~0. So 3.409? Wait no. Formula: Impact = 6.42 × ISS where ISS = 1 - [(1-C)(1-I)(1-A)]. With C:N, I:N, A:H → ISS = 1 - (1)(1)(1-0.56) = 0.56. Then for scope unchanged: Impact = 6.42 × ISS = 3.5952. Hmm, that's the scope-changed formula variant? Let me recall CVSS 3.1 spec: If Scope is Unchanged: Impact = 6.42 × ISS. If Scope Changed: Impact = 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15. Yes, so 3.5952 for unchanged. So base = min(Impact+Exploitability,10) × 1.08 = min(7.927,10)=7.927 → 7.927 × 1.08 = 8.561 → roundup = 8.6? No wait — the 1.08 multiplier is for Scope
An out-of-bounds write in FreeRDP's urbdrc (USB redirection) client channel allows a malicious or compromised RDP server to crash the connecting client. When the client loads the urbdrc channel, a crafted 28-byte USB redirection message drives urb_send_current_frame_number_result() to write 4 bytes past a 16-byte heap buffer, which trips an assertion (CWE-617) and terminates the process on builds with verbose asserts enabled. The flaw affects FreeRDP 3.14.0 through 3.30.0 and is fixed in 3.31.0; impact is availability only, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Let me produce the JSON. Key facts: - CVE-2026-91950, FreeRDP before 3.31.0 - OOB read in rdpdr_dump_packet due to 32-bit unsigned integer wraparound in buffer bounds validation - computerNameLen = 0xFFFFFFF0 bypasses bounds check → OOB read → client crash or heap disclosure in logs - CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-125 - VulnCheck reported - CPE: freerdp:freerdp all versions (up to before 3.31.0) - Tags: Buffer Overflow, Information Disclosure, Freerdp - References: GitHub security advisory GHSA-c5gr-hmqp-pwj4, VulnCheck advisory No EPSS, no KEV, no POC mentioned. Attack requires the client to connect to a malicious RDP server — UI:P (passive user interaction: the user connects to the server). PR:N. No privileges. AV:N because the malicious server is remote. Exploitation conditions: attacker must control/operate the RDP server the client connects to; requires the RDPDR (device redirection) virtual channel to be enabled/active — in FreeRDP, rdpdr is used for drive/printer/port redirection and is typically negotiated when the client has redirection enabled. Also the dump/log path (rdpdr_dump_packet is a debug dump function) — so triggering the crash likely requires the rdpdr debug logging/dump enabled? Hmm. The function rdpdr_dump_packet is a dumping function, likely compiled when WITH_DEBUG_RDPDR or verbose logging is enabled. Actually in FreeRDP, rdpdr_dump_packet exists in rdpdr_main.c guarded by... let's be careful. I'd say the OOB read occurs during packet dump/parsing on logging, so higher log verbosity may be required. I should state this as an inference and flag uncertainty. Remediation: upgrade to FreeRDP 3.31.0 or later; advisory link. Workarounds: disable device redirection (rdpdr), avoid connecting to untrusted RDP servers, reduce log verbosity, remove /drive /printer flags. Trade-offs. Prevalence: FreeRDP is widely deployed as the RDP client in Linux distros, ThinLinc, etc. — high (widely depl
Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.
Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
FreeRDP deployments running the RDPGFX server-side graphics pipeline before version 3.31.0 leak uninitialized heap memory to any authenticated RDP client, because the ResetGraphics PDU serializer leaves the padding bytes of its fixed 340-byte wire structure untouched. The leaked bytes can contain live heap pointers and GLib function addresses, which defeats heap ASLR and reveals the GLib module base address — a strong primitive for chaining into further memory-corruption exploits. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, though the fix commit is publicly visible, making the flaw trivially reverse-engineerable.
The user wants a JSON analysis. Let me note the details. CVE-2026-91945: FreeRDP before 3.31.0, OOB read in smartcard response decoders failing to validate ATR length fields. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses. CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CWE-125. Patch available from vendor, commit 9626564421df72c84f891afdbc0b20bf702f369f. Reported by VulnCheck. Note: the commit diff shown appears unrelated to the actual fix (CMakeLists.txt winpr change) — that's a data quality flag potentially. Actually the diff snippet seems to be CMake version check — not the actual security fix. Hmm. Could mention in confidence notes as suspicious/mismatched patch reference. But careful — the diff is truncated; only showing part. I could flag it. Tags: Buffer Overflow, Information Disclosure, Freerdp. "Buffer Overflow" is arguably a mislabel — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag could be considered mislabeled. That's a plausible data_quality_flag: mislabeled_tag target "Buffer Overflow", suggested "out-of-bounds-read". Confidence medium. Actually the instructions say only emit flag when clearly wrong and verifiable from references. CWE-125 out-of-bounds read is a memory read, not a classic buffer overflow (CWE-120/787 write). Description explicitly says "out-of-bounds read" causing process termination. So the "Buffer Overflow" tag is misleading. I'd emit a medium-confidence flag. Also "freerdp" tag present as "Freerdp" — it's lowercase normalized presumably fine. Missing tags? Possibly "smartcard"? Not a standard tag. Maybe "cwe-125"? Not necessarily. I'll skip missing tags. Prevalence: FreeRDP is a widely used open-source RDP client library — high? It's used in many Linux distributions, thin clients, etc. I'd say "high" or "medium". FreeRDP is the de facto open source RDP implementation, bundled in distros, used by ma
Uninitialized heap memory disclosure in FreeRDP 3.0.0-3.30.0 exposes up to 576 bytes of stale server or proxy heap contents - potentially including cleartext credentials from prior RDP sessions - to any authenticated downstream RDP client. Three PDU-serialization functions in libfreerdp/core/info.c advance the stream write pointer with Stream_Seek over reserved padding bytes instead of zeroing them with Stream_Zero, leaving prior malloc heap contents in Save Session Info PDUs transmitted to clients. FreeRDP-based server deployments and freerdp-proxy instances are the affected roles; a vendor-confirmed fix ships in version 3.31.0, and no public exploit or active exploitation has been identified at time of analysis.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. No public exploit has been identified at time of analysis, but the confirmed heap write primitive and RCE classification make this a credible code execution risk for susceptible client builds connecting to untrusted servers.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Server-side authentication bypass in FreeRDP 3.x (confirmed through 3.27.1) allows an unauthenticated remote attacker to obtain a fully authenticated RDP session without supplying any credentials, GUID, or reconnect cookie when the server has RdstlsSecurity enabled. The flaw combines PDU-type confusion - the server routes inbound messages based solely on the client-supplied wire pduType without enforcing handshake state - with a calloc-zeroed result code that maps directly to RDSTLS_RESULT_SUCCESS, so sending a Capabilities PDU in place of the required Authentication Request PDU produces an unconditional authentication success response. No public exploit code or CISA KEV listing has been identified at time of analysis; the upstream fix commit is confirmed but a released patched version was not independently verified at advisory time.
Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Integer overflow in FreeRDP's audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends affects all versions before 3.29.0, exploitable by a malicious or compromised RDP server. The server can supply a crafted FramesPerPacket value that causes allocation size wraparound, leading to a heap-based buffer overflow on Linux/ALSA - potentially enabling code execution - or denial of service on all supported platforms. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; vendor-released patch (3.29.0) is available.
Heap-based buffer overflow in FreeRDP's Windows clipboard client (versions ≤ 3.29.0) allows a malicious or compromised RDP server to write attacker-controlled data beyond the bounds of a paste consumer's heap allocation. The flaw in CliprdrStream_Read trusts the server-supplied response length (req_fsize) rather than the caller-supplied buffer bound (cb), so any OLE paste consumer such as explorer.exe that calls IStream::Read against server-offered clipboard file contents can have its heap corrupted. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and a fix is available in FreeRDP 3.30.0.
Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.
Heap out-of-bounds read in FreeRDP's glyph cache subsystem (versions <= 3.28.0) allows a malicious or compromised RDP server to crash any connecting FreeRDP client by sending a GLYPH_FRAGMENT_ADD update with a server-controlled declared fragment size that exceeds the actual received buffer. The vulnerability exists because update_process_glyph_fragments() and glyph_cache_fragment_put() in libfreerdp/cache/glyph.c read a one-byte declared size and proceed to allocate and copy that many bytes without first validating that the declared size fits within the remaining data in the received packet. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with AV:N/AC:L/PR:N reflects trivial remote exploitation requiring only a client connection to a rogue server.
Heap use-after-free in FreeRDP's asynchronous update message proxy (all versions before 3.29.0) enables a malicious or compromised RDP server to crash the connecting client or induce memory corruption by sending crafted RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER update packets. The vulnerability surfaces only when the AsyncUpdate option is enabled on the client, limiting but not eliminating real-world exposure given the feature's performance benefits and common usage. Vendor-released patch version 3.29.0 is available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap use-after-free in FreeRDP's async update message proxy allows a malicious or compromised RDP server to crash the client and corrupt heap memory through a crafted RAIL WINDOW_ORDER_ICON message. The flaw is gated on the AsyncUpdate feature being explicitly enabled via the /async-update flag - a non-default client configuration - which limits real-world exposure relative to the CVSS 4.0 score of 8.7. All FreeRDP versions prior to 3.29.0 (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.
Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
TLS server certificate purpose validation bypass in FreeRDP before 3.29.0 allows a trusted, hostname-matching certificate issued only for client authentication (clientAuth EKU) to be accepted as a valid RDP server certificate. This weakens the trust model in environments that rely on Extended Key Usage separation between client and server certificates, enabling an attacker who can present such a certificate to impersonate the RDP server. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and not listed in CISA KEV.
Denial of service in FreeRDP before 3.29.0 allows any unauthenticated network-reachable RDP client to exhaust server memory by sending a crafted RDPEI PDU with a large declared body length and no corresponding body data. The RDPEI server channel handler allocates a stream buffer sized to the attacker-controlled length field without first validating it against any maximum, making exploitation trivially repeatable. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the unauthenticated pre-auth vector (CVSS 4.0 PR:N, AV:N, AC:L) and 8.7 score indicate meaningful priority for deployments running FreeRDP in server mode.
Null pointer dereference in FreeRDP's smartcard virtual channel allows remote unauthenticated attackers to crash the process by sending malformed smartcard IRP (I/O Request Packet) requests. All FreeRDP releases before 3.29.0 are affected: crafting an IRP with a non-zero cReaders field but truncated reader-state payload causes the decoder to fail, after which the free_reader_states cleanup function dereferences a null pointer and terminates the session. Impact is limited to denial of service - no confidentiality or integrity compromise is possible. No public exploit code or CISA KEV listing identified at time of analysis.
TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.
Memory exhaustion in FreeRDP before 3.29.0 allows unauthenticated attackers controlling a malicious RD Gateway endpoint to crash the client by sending Transfer-Encoding: chunked HTTP response bodies of unbounded size. The `http_response_recv_body()` function fails to enforce the configured `RESPONSE_SIZE_LIMIT` exclusively for chunked responses, creating an exploitable gap in the intended safety boundary. No active exploitation (CISA KEV) or public POC has been identified, but the CVSS 4.0 score of 8.7 reflects the low attack complexity once an attacker can serve a malicious gateway response.
Out-of-bounds read in FreeRDP's async update message proxy exposes clients to memory disclosure or process crash when connecting to a malicious or compromised RDP server with AsyncUpdate enabled. The flaw is in update_message_PolygonSC() and update_message_PolygonCB(), which allocate a fresh points array but copy data from the enclosing order structure's base address rather than from the correct ->points member, reading adjacent heap memory. All FreeRDP versions before 3.29.0 are affected; no CISA KEV listing and no public exploit code exist at time of analysis.
TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap-based remote code execution in the FreeRDP Windows client (all versions before 3.29.0) is triggered when a user pastes clipboard content sourced from a malicious RDP server. The client fails to validate the server-supplied data size in CLIPRDR_FILE_CONTENTS_RESPONSE PDUs against the destination buffer, allowing an oversized payload to corrupt heap memory. A publicly available vendor advisory (GHSA-cj9v-h4hq-29jr, reported by VulnCheck) documents the flaw; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap out-of-bounds read in FreeRDP's TSMF FFmpeg decoder allows a malicious RDP server to crash connecting client processes by sending malformed AVC1 MPEG2VIDEOINFO media type data with undersized ExtraData buffers. All FreeRDP releases prior to 3.29.0 are affected (CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*), with the root cause being fixed-offset heap reads in the media format parser that proceed without validating source buffer length - a CWE-125 pattern. No CISA KEV listing or public exploit code has been identified at time of analysis; the vendor has released a patch at version 3.29.0 and the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity consequence per the provided vector.
Argument injection in FreeRDP before 3.28.0 lets a malicious .rdp connection file smuggle arbitrary command-line options into the client, because any line beginning with a forward slash is passed straight to the CLI parser rather than treated as an RDP setting. An attacker who convinces a victim to open a crafted RDP file can invoke options such as /rdp2tcp (command execution), /cert:ignore (certificate-validation bypass), or /drive (local filesystem exposure) the moment the file is opened. There is no public exploit identified at time of analysis, but the fix is published (3.28.0) alongside a coordinated VulnCheck and GitHub security advisory.
Client-side double-free (CWE-415) in FreeRDP's .rdp connection-file parser lets an attacker who tricks a victim into opening a malicious .rdp file corrupt heap memory, potentially leading to a crash or code execution in xfreerdp/sdl-freerdp/wlfreerdp. The flaw is in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c), where a non-owning pointer to the settings-owned MonitorIds array is freed on a strtoul error path without clearing settings->MonitorIds, so freerdp_settings_free() frees the same buffer again at teardown. All 3.x releases through 3.27.1 are affected in the default configuration and it is fixed in 3.28.0; there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided.
Denial of service in FreeRDP servers (versions <=3.27.1) allows unauthenticated remote attackers to crash the service by forging a malicious encrypted client random during RDP Standard Security negotiation. Because the server publishes its RSA public key, an attacker can craft a ciphertext whose decrypted plaintext spans the full RSA modulus (up to 256 bytes for RSA-2048), overflowing a fixed 32-byte heap buffer in crypto_rsa_common() by roughly 224 attacker-controlled bytes before any authentication occurs. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix landed in FreeRDP 3.28.0.
An off-by-one out-of-bounds read in the FreeRDP glyph cache (CWE-125) allows a malicious or compromised RDP server to trigger a memory access past the end of the cached glyph entries array in FreeRDP clients before version 3.27.0. Exploitation requires the victim to initiate an outbound RDP connection to the attacker-controlled server (UI:R), but no authentication is required (PR:N), and default client configurations are exposed because glyph caching is standard RDP functionality. The flaw can crash the client (A:H) and cause limited memory disclosure (C:L); EPSS is low at 0.37% (30th percentile) and no public exploit code or CISA KEV confirmation was identified at time of analysis.
Heap-based buffer overflow in FreeRDP (the widely used open-source RDP client library) allows a malicious or compromised RDP server to corrupt client memory and potentially achieve remote code execution in the connecting client's context. The flaw lives in the primary drawing-order parser (update_read_delta_points in libfreerdp/core/orders.c), where an inverted integer-overflow guard let an attacker-controlled point count produce an undersized heap allocation followed by an out-of-bounds write. No public exploit identified at time of analysis; the issue is fixed in FreeRDP 3.28.0 (GHSA-v5wf-j8j4-77h7).
## Summary Remote code execution and denial of service in FreeRDP before 3.22.0 stem from a use-after-free in the dynamic virtual channel manager (drdynvc), where `dvcman_channel_close` and `dvcman_call_on_receive` access `channel_callback` without proper synchronization (CWE-362). A malicious or compromised RDP server can race DYNVC_DATA and DYNVC_CLOSE messages to free a channel callback while another thread still uses it, corrupting the client heap. This is a client-side flaw affecting anyone connecting to an attacker-controlled server; no public exploit identified at time of analysis, and it is not listed in CISA KEV. ## Technical Context FreeRDP is a widely used open-source implementation of the Microsoft Remote Desktop Protocol, embedded in clients such as Remmina, GNOME Connections, Weston, and numerous commercial and VDI products. The bug lives in the drdynvc (Dynamic Virtual Channel) subsystem, which multiplexes optional channels (clipboard, audio, device redirection, etc.) over the RDP connection and processes them on a dedicated client thread. Per CWE-362 (concurrent execution using shared resource with improper synchronization / race condition), `dvcman_channel_close` (handling DYNVC_CLOSE) can free the `channel_callback` structure while `dvcman_call_on_receive` (handling DYNVC_DATA) is concurrently dereferencing it, producing a heap use-after-free. Because the RDP server dictates the timing and ordering of DYNVC_DATA and DYNVC_CLOSE PDUs, a hostile server controls the race window. ## Risk Assessment The published CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H) yields 8.3 (High), driven mainly by high availability impact with lower confidentiality/integrity impact — consistent with a heap corruption that reliably crashes the client (DoS) but only potentially yields RCE. AC:H correctly reflects that success depends on winning a non-deterministic thread race, which is unreliable and may require many attempts. There is no EPSS score, no KEV listing, and no confirmed public POC in the provided data, so exploitation pressure is currently low-to-unknown; the RCE and Denial Of Service tags reflect potential impact, not observed attacks. One nuance to verify: the vector uses UI:N/PR:N, but this is a client-side vulnerability requiring the victim to connect to a malicious server — a real-world limiting factor that raw CVSS understates. Net: a legitimate patch priority for fleets whose users connect to untrusted or reachable RDP endpoints, but not an emergency mass-exploitation scenario given AC:H and no evidence of exploitation. ## Affected Products FreeRDP (the open-source RDP client/library and its FreeRDP-based clients) at all versions prior to 3.22.0 are affected; the flaw is fixed in FreeRDP 3.22.0. No CPE strings were provided in the input, so exact downstream package ranges (e.g., distribution builds of Remmina or the freerdp2/freerdp3 packages) should be confirmed against vendor trackers. Authoritative details are in the FreeRDP GitHub Security Advisory GHSA-3mv2-5q57-2v8h (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h) and the VulnCheck advisory (https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback). ## Remediation Vendor-released patch: FreeRDP 3.22.0 — upgrade all FreeRDP libraries and any FreeRDP-based clients (Remmina, GNOME Connections, xrdp clients, etc.) to 3.22.0 or later, rebuilding or updating downstream distribution packages that bundle the library. Until patched, reduce exposure by only connecting to trusted, known-good RDP servers and avoiding connections to untrusted or attacker-influenced hosts, since the malicious behavior originates server-side; where feasible, restrict outbound RDP (TCP 3389) from client machines to an allowlist of approved servers via egress firewall rules (trade-off: breaks ad-hoc connections to new servers). If specific dynamic virtual channels are not required, disabling optional channel redirections (clipboard, drive, audio) narrows the attack surface of drdynvc but does not fully eliminate the race and reduces functionality. Follow guidance in GHSA-3mv2-5q57-2v8h (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h) and the VulnCheck advisory (https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback). ## Exploit Scenario An attacker stands up or compromises an RDP server and lures a victim into connecting with a vulnerable FreeRDP client (e.g., via a malicious .rdp file, phishing link, or a man-in-the-middle position). Once connected, the server rapidly interleaves DYNVC_DATA and DYNVC_CLOSE messages on a dynamic virtual channel to win the race and trigger the heap use-after-free in the client's drdynvc thread, crashing the client or, with careful heap grooming, potentially executing code in the client process. No public POC is identified at this time, and the AC:H race condition makes reliable code execution difficult. ## Exploitation Conditions Exploitation requires the victim to establish an RDP session to an attacker-controlled or compromised server running against a FreeRDP client before 3.22.0, and the connection must use the drdynvc dynamic virtual channel path. The attacker must then concurrently send DYNVC_DATA and DYNVC_CLOSE messages on a dynamic virtual channel to win a timing race in `channel_callback` access. Limiting factors: the attacker must control the RDP server side (this is a client-side vulnerability, so it cannot be triggered against an unwilling client that never connects), the exploit depends on winning a non-deterministic thread race (CVSS AC:H) so it is unreliable and may require repeated attempts, and reliable code execution beyond a crash requires heap-layout control. No authentication to the malicious server is needed, but the user must initiate the outbound connection. ## Attack Chain Lure victim to malicious RDP server → Client opens dynamic virtual channel (drdynvc) → Server races DYNVC_DATA and DYNVC_CLOSE → Trigger heap use-after-free on channel_callback → Crash client or execute code in client process ## Confidence Notes Affected/fixed version (before 3.22.0; fixed in 3.22.0), root cause, and functions are confirmed by the FreeRDP GitHub Security Advisory GHSA-3mv2-5q57-2v8h and the VulnCheck advisory. CVSS 4.0 vector, 8.3 score, and CWE-362 are provided in the input; RCE is described as potential, not demonstrated. Not listed in CISA KEV and no EPSS score or public POC was provided, so real-world exploitation status is unknown; downstream package version ranges are not confirmed due to absent CPE data. ## Prevalence high ## Prevalence Basis core open-source RDP library embedded in many Linux remote-desktop clients ## Assessed CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H ## Assessed CVSS Rationale Client-side flaw needing the victim to connect to a malicious server (UI:R) and to win a thread race (AC:H); heap corruption gives high availability impact with limited C/I. ## Assessed CVSS 4.0 Vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Out-of-bounds heap write in FreeRDP versions prior to 3.26.0 allows remote attackers to corrupt memory in the planar bitmap decoder when an RDP client connects to a malicious or compromised server. The flaw lives in freerdp_bitmap_decompress_planar() in libfreerdp/codec/planar.c, where attacker-controlled stride and X-destination values bypass bounds checks against the internal pTempData buffer. No public exploit identified at time of analysis, but the issue is fixed upstream in 3.26.0.
Heap buffer overflow write in FreeRDP's server-side clipboard (cliprdr) channel allows a malicious RDP client to crash server processes and potentially achieve remote code execution against FreeRDP versions prior to 3.26.0. The flaw is triggered by a malformed CB_CLIP_CAPS PDU with an undersized capabilitySetLength field, corrupting heap memory after authentication. No public exploit identified at time of analysis, but the CVSS 8.8 rating and heap corruption nature make this a high-priority patch for any RDP server deployment using FreeRDP.
Heap use-after-free/double-free in the FreeRDP RDP client (versions prior to 3.26.0) lets a malicious or compromised RDP server corrupt client memory through the RDPEAR authentication-redirection path. The flaw stems from the RDPEAR NDR parser reusing a single non-null pointer ref-id across multiple logical fields, causing the same heap object to be assigned to two outputs and freed twice by the generic destructor. There is no public exploit beyond a proof-of-concept (SSVC: poc), and EPSS exploitation probability is very low (0.05%), but the SSVC technical impact is rated total and a vendor fix is available.
Heap buffer overflow write in FreeRDP client versions prior to 3.26.0 allows a malicious RDP server to corrupt client memory and potentially achieve code execution when the victim connects with RDPGFX enabled. The flaw resides in gdi_CacheToSurface, where validation uses a clamped destination rectangle while the actual copy uses unclamped cacheEntry width/height values, enabling a large out-of-bounds heap write. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer overflow in FreeRDP versions prior to 3.26.0 allows a malicious RDP server to write out-of-bounds heap memory on connecting clients through the gdi_CacheToSurface function, potentially leading to remote code execution or client crash. The flaw stems from inconsistent rectangle validation where coordinates are clamped to UINT16_MAX but copy operations use unclamped cache entry dimensions. Publicly available exploit code exists per SSVC, though EPSS exploitation probability remains low at 0.06%.
Heap buffer overflow in FreeRDP's persistent bitmap cache handling allows local attackers to corrupt memory integrity and crash the RDP client. Affecting all versions prior to 3.24.2, the vulnerability (CWE-122) occurs when memory reallocation fails but the buffer size variable is prematurely updated, creating a size/pointer mismatch. EPSS data not available, but marked medium priority by Ubuntu. No public exploit identified at time of analysis, though technical details are disclosed in the GitHub Security Advisory.
Heap buffer overflow in FreeRDP's H.264 YUV decoder (versions before 3.24.2) allows remote attackers to potentially achieve code execution via specially crafted RDP sessions. The vulnerability stems from premature dimension updates in yuv_ensure_buffer() that persist when memory reallocation fails, creating exploitable memory corruption conditions. Attack requires user interaction (connecting to malicious RDP server) and moderate complexity (CVSS AC:H). No public exploit identified at time of analysis, though CVSS 7.5 HIGH score reflects potential for complete system compromise (C:H/I:H/A:H).
Heap buffer overflow in FreeRDP's CLEAR codec implementation allows remote attackers to execute arbitrary code when processing malicious RDP server responses. Affects all FreeRDP versions prior to 3.24.2. Attack requires high complexity and user interaction (victim must connect to attacker-controlled RDP server), but no authentication is required. CVSS 7.5 reflects the network-accessible attack vector with potential for complete system compromise. No public exploit identified at time of analysis, though technical details are publicly disclosed via GitHub security advisory.
Heap-buffer-overflow in FreeRDP's winpr_aligned_offset_recalloc() function allows local attackers with no privileges but requiring user interaction to trigger high-severity information disclosure and denial of service in versions prior to 3.24.2. The vulnerability involves a READ operation at 24 bytes before heap allocation boundaries (CWE-125: Out-of-bounds Read). Vendor-released patch version 3.24.2 available via GitHub commit a48dbde2c8. EPSS data not provided; no public exploit identified at time of analysis. Affects all FreeRDP installations below 3.24.2, tracked across 7 Debian releases.
Heap buffer overflow in FreeRDP's NSCodec surface-bits handler (versions prior to 3.24.0) lets a malicious or compromised RDP server corrupt heap memory on connecting clients. The gdi_surface_bits() path passes server-supplied bmp.width and bmp.height into nsc_process_message() without validating them against the actual desktop dimensions, and because the attacker also controls the decoded pixel data, the out-of-bounds write can overwrite adjacent heap allocations with attacker-chosen bytes - a potential path to remote code execution. EPSS is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
FreeRDP versions prior to 3.23.0 contain an incomplete fix for a heap-use-after-free vulnerability that affects only the SDL2 code path, where freed memory pointers are not properly nulled, allowing an unauthenticated attacker to trigger a denial of service condition. Users running FreeRDP with SDL2 backends remain vulnerable despite the advisory claiming the issue was resolved. Upgrade to version 3.23.0 or later to obtain the complete fix.
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 8.8 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 8.8 HIGH]
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Unauthenticated keyboard injection in the FreeRDP shadow server (versions 3.0.0 through 3.31.x) allows remote attackers to send synthetic keystrokes into a host user's X11 session via XTEST by delivering an input PDU during the Confirm Active state, before any authentication takes place. Exploitation requires the shadow/mirroring server to be network-reachable and the host to be running an X11 session over a TLS-only RDP negotiation; the confirmed impact is integrity-only (fabricated input) with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
Unbounded heap accumulation in the FreeRDP proxy (the pf/proxy relay component) lets unauthenticated remote attackers exhaust proxy memory by streaming RDPDR device-redirection fragments that begin with a FIRST fragment but never carry a LAST fragment, so reassembly state grows in proportion to bytes sent. Affected deployments are FreeRDP 3.0.0-beta1 through versions before 3.32.0 that run the proxy with the RDPDR channel reachable from untrusted clients; plain FreeRDP client or server deployments are not the stated target. Rated CVSS 4.0 8.2 (High), with assessed CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, this is a slow-burn memory-exhaustion DoS requiring sustained fragment traffic rather than a single packet, and there is no public exploit identified at time of analysis.
Authenticated RDP clients can force unbounded server-side memory allocation in FreeRDP 2.0.0 through 3.31.x by sending a seven-byte DATA_FIRST message on an already-opened dynamic virtual channel (DVC) that declares a large 32-bit length, driving zeroed resident-memory growth until the server's resources are exhausted and service is denied. The flaw is availability-only (CWE-400 resource exhaustion; CVSS 4.0 base 7.1, assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure impact, and every action requires a valid authenticated session plus a successfully opened DVC - so real exposure depends on who can authenticate to the RDP service, and it is not remotely exploitable without credentials. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
FreeRDP 3.0.0 through 3.31.x allows a malicious RDP server to brute-force the smartcard PIN of a connecting client by resetting the per-handle retry counter in the virtual smartcard GIDS implementation. The attack requires the victim to initiate an RDP session to an attacker-controlled server while smartcard redirection is configured (UI:P/UI:R), and no public exploit code has been identified at time of analysis. This is a moderate-priority confidentiality issue (CVSS 4.0 7.1; independent CVSS 3.1 rates impact as C:H only) that can lead to PIN disclosure but not code execution or integrity/availability impact.
Memory exhaustion denial of service in FreeRDP 3.20.1 up to but not including 3.32.0 lets a malicious or compromised RDP server crash connecting clients by abusing drive redirection read requests. Per the CVSS v4 vector (PR:N, UI:P), the attack is remote and the client side of the protocol is unauthenticated, but exploitation is conditional: the victim must be induced to initiate an RDP session to the attacker-controlled server and must have drive redirection (rdpdr) active for the server to issue the offending IRP_MJ_READ requests. Impact is confined to availability (client memory exhaustion and crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Denial of service in FreeRDP client versions 3.11.0 through 3.31.x allows a malicious or compromised RDP server to abort a connected client process: once the RDPGFX graphics channel negotiates the AVC444 or AVC444v2 codec, the server can send an otherwise in-bounds region rectangle with an odd width, which bypasses the missing even-width validation before YUV444 conversion and trips a CWE-617 reachable assertion. Per the CVSS vector (PR:N, UI:P), the attack requires no authentication on the client side, but the victim must initiate or accept the connection to the hostile server, and the resulting impact is confined to availability of that single client process - no confidentiality or integrity loss and no code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so real-world risk is moderate and bounded by the requirement that the attacker controls the RDP server side.
Denial of service in the FreeRDP RDP client (versions 3.0.0 through 3.31.x) allows a malicious or compromised RDP server to crash a connecting client that has both smartcard emulation and smartcard redirection enabled: the server releases a smartcard-emulation context, establishes a new one, then issues SCardTransmit with the stale card handle, causing the client to look up the deleted parent context and hit a terminating WINPR_ASSERT. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) confirms this is network-reachable and unauthenticated, but it requires the victim to actively initiate a connection outward to the hostile server, and the impact is availability-only (client process abort, no code execution or data disclosure). No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation also depends on the non-default smartcard emulation/redirection feature set being enabled.
Denial of service in FreeRDP clients: versions 3.29.0 through 3.31.x contain a double free (CWE-415) in the async-update message proxy that a malicious or compromised RDP server can trigger by sending a point-bearing PolygonSC or PolygonCB order followed by a second polygon order with numPoints set to zero, crashing the connecting client. Exploitation requires the victim to connect to an attacker-controlled server and to have launched the client with the non-default +async-update option, so default client configurations are not exposed; user interaction is needed to initiate the connection, and impact is limited to availability with no code execution, data disclosure, or integrity loss. There is no confirmation of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; the observed CVSS 4.0 score of 7.1 is driven by the availability impact.
NULL pointer dereference in FreeRDP's Remote Desktop Gateway (RDG) transport path affects client builds from 2.3.0 up to (but not including) 3.32.0, allowing an attacker who controls or has compromised the RD Gateway to crash a connecting client. The malicious gateway only needs to return an eight-byte, header-only PKT_TYPE_CLOSE_CHANNEL control packet; rdg_process_control_packet forwards the absent payload to rdg_process_close_packet without a NULL check, and the client dereferences it. The attacker must already occupy the gateway position (not an arbitrary remote host) and the user must initiate the outbound RDP session, so this is a bounded, availability-only denial of service - CVSS v4.0 base 7.1, with the independent assessment scoring it AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the gateway-position prerequisite constrains realistic abuse.
FreeRDP clients 2.3.0 through 3.31.x can be hung by a malicious or compromised RD Gateway that returns an incomplete HTTP chunked response and then cleanly closes the TLS connection. The bug is an infinite loop (CWE-835) in http_chuncked_read: zero-byte reads after a truncated chunk-size line or footer keep the decoder thread spinning, causing a client-side denial of service. This is a remote, unauthenticated availability-only issue per the provided CVSS vector (PR:N) but requires the victim to initiate the gateway connection (UI:P/UI:R); no public exploit identified at time of analysis.
FreeRDP clients running versions 3.27.1 through 3.31.x with the non-default Bitmap Cache V3 feature enabled can be crashed by a malicious or compromised RDP server that sends a crafted Cache Bitmap V3 order during connection setup. The NULL pointer dereference occurs because the client bitmap cache is accessed before it is initialized when the CBR3_DO_NOT_CACHE flag is set, leading to a denial-of-service (availability impact only, no confidentiality or integrity loss). Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server and have enabled the Bitmap Cache V3 codec via /cache:codec:<rfx|nsc|jpeg>; default configurations are not affected, and no public exploit code has been identified at time of analysis.
A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.
A reachable assertion in the FreeRDP client (3.0.0-beta1 through versions prior to 3.32.0) allows a malicious RDP server to crash a connecting client. When the client is built with verbose WinPR assertions enabled and is using smartcard emulation, the emulated SCardStatusA handler forwards a NULL reader-name destination to scard_copy_strings; a server that sends an SCardStatusA request with fmszReaderNamesIsNULL=1 triggers that assertion and aborts the client process. Impact is limited to a client-side denial of service against a single connecting session - no code execution, lateral movement, or credential impact - and exploitation demands both non-default build/runtime settings and a victim who initiates a connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided, but the narrow configuration prerequisites keep real-world urgency low despite the 7.1 CVSS 4.0 score.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Use-after-free in FreeRDP's smartcard redirection allows a malicious RDP server to corrupt memory on a connecting client, potentially leading to crashes or code execution. Affected versions are 3.0.0-beta1 through 3.31.x; exploitation requires the victim to connect to an attacker-controlled server with the smartcard channel active, and no public exploit identified at time of analysis.
A malicious RDP client can crash a FreeRDP-based RDP server running versions before 3.32.0 by negotiating the NSCodec and requesting an oversized desktop geometry, which forces a buffer-growth allocation failure inside nsc_context_initialize_encode() and leaves dangling plane pointers that are later double-freed during context teardown. The impact is availability-only - no code execution, data exposure, or persistence - and the attack is unauthenticated (CVSS PR:N), but success depends on actually inducing the allocation failure, so the trigger is not perfectly deterministic and the vulnerable server-mode deployment is less common than FreeRDP's client-side use. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-priority crash issue rather than the more alarming 8.2 CVSS 4.0 base score suggests.
Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.
A divide-by-zero in FreeRDP's freerdp-shadow-cli shadow server (versions before 3.32.0) allows an authenticated client to crash the process by sending a Frame Acknowledge PDU with a frame id one greater than the last frame sent, disconnecting all viewers. Exploitation requires a valid authenticated session and only affects the non-default shadow server deployment; no user interaction is needed and complexity is low. No public exploit code has been identified at time of analysis, and the impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
FreeRDP 3.0.0 through 3.31.x allows an on-path attacker to capture OAuth authorization codes and substitute the OpenID discovery document during Azure AD authentication because freerdp_http_request() completes TLS handshakes without validating the server certificate chain. Exploitation requires the victim to use the Azure AD/AAD-brokered RDP path (plain RDP is unaffected) and to actively perform the login while the attacker holds a man-in-the-middle network position, making this a conditional risk rather than a broadly exploitable flaw. No public exploit code has been identified at time of analysis, and the issue is patched in FreeRDP 3.32.0.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Heap-based buffer overflow in FreeRDP client versions before 3.31.0 allows a malicious or compromised RDP server to corrupt client memory by sending a Server Redirection PDU whose LoadBalanceInfo field is longer than the fixed 512-byte heap buffer used in nego_send_negotiation_request. Successful exploitation crashes the client and, when chained with a memory-disclosure primitive, could lead to code execution on the connecting workstation. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record, so current exploitation appears opportunistic rather than confirmed in the wild.
FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.
FreeRDP clients before 3.31.0 terminate unexpectedly when connected to a malicious RDP server, because the URBDRC (USB redirection) control-transfer request path forwards an attacker-supplied OutputBufferSize of 65536 to the libusb backend without validating it, hitting a reachable assertion. The attacker must control the RDP server and convince a user to connect, so exploitation is network-facing but user-initiated. Impact is limited to availability (client process crash) rather than code execution or data exposure; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in FreeRDP clients before 3.31.0: a rogue or compromised RD Gateway can send a WebSocket Ping frame with a crafted 64-bit extended payload length that wraps an integer inside WinPR's Stream_EnsureRemainingCapacity, producing a double free that crashes the client while the connection is being established. Exploitation requires no credentials on the attacker's side and only a victim client that routes its session through that gateway over the WebSocket transport; the primary impact is loss of availability of the client session. Vendor-released patches are available in FreeRDP 3.31.0, and there is no public exploit code or active exploitation reported in the supplied intelligence.
Let me synthesize. CVE-2026-91959: FreeRDP buffer over-read in rts_read_result (RPC gateway transport parser), truncated BIND_ACK PDU result entry → OOB read → process abort (DoS). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H — network, no privileges, passive UI (UI:P means user must perform... in CVSS 4.0, UI:P = Passive, meaning the user just needs to interact minimally, like a client connecting), high availability impact only. So no confidentiality/integrity impact despite the "Information Disclosure" tag — actually the tag "Information Disclosure" seems mislabeled since VC:N. Hmm — buffer over-read could disclose memory, but the CVSS says VC:N. The description says process abort (DoS). So the tag "Information Disclosure" is arguably mislabeled — but do I want to emit a data_quality_flag? The tags list: "Buffer Overflow, Information Disclosure, Freerdp". "Buffer Overflow" is arguably wrong too — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag on an over-read is a mislabel... The instructions say only emit a flag when the input metadata is clearly wrong and verifiable. Information Disclosure: an OOB read technically can leak memory, but CVSS says VC:N and description says process abort. I'd say low confidence. Buffer Overflow mislabel — CWE-125 is "Out-of-bounds Read", which is distinct from buffer overflow (CWE-787/CWE-120). Hmm, but many tag taxonomies lump them. I'll emit one flag with medium confidence for "Information Disclosure"? Actually the guidance says flags should be high-confidence and verifiable. Maybe emit a flag for "Buffer Overflow" as mislabeled_tag with suggested "out-of-bounds-read"... but 'suggested' is "the correct/canonical slug if you know it". Hmm. I think I can include one flag with medium confidence. Risk: noise. The instructions say empty array is common and correct. Given CWE-125 ≠ buffer overflow and CVSS shows VC:N (no info disclosure), I think two tags are arguably mislabeled. But
Client-side denial of service in FreeRDP before 3.31.0: the URBDRC (USB redirection) channel's func_get_ep_desc function indexes interface arrays by positional offset instead of the protocol's InterfaceNumber field, so a malicious or compromised RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and trigger an out-of-bounds heap read that crashes the connecting client. The flaw only degrades availability (no confidentiality or integrity impact per the CVSS 4.0 vector), requires the victim to initiate a session against the hostile server, and no public exploit code or active exploitation has been reported at time of analysis. It is a targeted-attacker nuisance rather than a mass-exploitation risk, but patching to 3.31.0 is straightforward.
Remote, unauthenticated attackers can crash any FreeRDP-based RDP server running a version prior to 3.31.0 by sending crafted RDP connection packets that supply zero or oversized DesktopWidth and DesktopHeight values during GCC capability negotiation. The malformed dimensions are used unchecked in multifragment update capability calculations, producing a division-by-zero (CWE-369) or assertion failure that terminates the server process. This is a pure availability impact (CVSS 4.0 base 8.2, VC:N/VI:N/VA:H); no publicly available exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis.
FreeRDP clients before 3.31.0 crash when a malicious RDP server sends a crafted Surface Bits command advertising the NSCodec codec ID — the GDI surface-bits handler dereferences a NULL decoder pointer instead of rejecting the unsupported codec. The victim only has to initiate an RDP session to an attacker-controlled or compromised server; the outcome is a client-side denial of service (application crash), with no memory corruption, code execution, or data exposure reported. No public exploit code and no CISA KEV listing were identified at time of analysis.
FreeRDP versions before 3.31.0 contain a heap buffer overflow in the client-side negotiation routine nego_send_negotiation_request(), which writes the server-supplied LB_LOAD_BALANCE_INFO field into a fixed 512-byte buffer without checking its length. A malicious RDP server — or an attacker positioned as a man-in-the-middle — can trigger the overflow by replying to a client's connection attempt with a Server Redirection PDU carrying an oversized LB_LOAD_BALANCE_INFO value, corrupting heap memory before authentication even completes. The confirmed impact is denial of service or heap corruption (CVSS 7.1, availability-only); no public exploit code and no CISA KEV listing were identified at time of analysis.
Let me write the JSON. Product: FreeRDP. CVE-2026-91952, infinite loop DoS in pool_decode_rect with AVC444 metablocks, client-side vulnerability — malicious RDP server attacks clients. AV:N, AC:L, PR:N, UI:P (UI passive), VA:H only. No KEV, no POC mentioned. CVSS 3.1 assessed: client connects to malicious RDP server. Attack vector network, AC:L? The crafted server response triggers loop — no special conditions besides connecting to malicious server (user interaction passive). PR:N. UI:P. C/I:N, A:H. S:U. So CVSS:3.1/AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H = 6.5? Let's compute: base score for AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H. Exploitability = 8.22 × 1.0 × 0.85 × 0.62 = 8.22*0.85=6.987; *0.62=4.332. Impact = 6.42 × 0.31? A:H → ISCBase = 1 - (1-0)(1-0)(1-0.56) = 0.56. Impact = 6.42 × 0.56 = 3.595. Total = roundup(min(3.595+4.332, 10)) = roundup(7.927) = 7.9. Hmm, that's odd — but that's standard: CVE with A:H and UI:P gives ~7.9? Actually wait, the numbers given in the prompt: 7.1 for CVSS 4.0. Let me just compute 3.1: 7.9? Let me double-check exploitability with UI:P (0.62). Yes 8.22*0.85*0.62 = 4.3319. And impact 3.5952. Sum 7.927 → roundup = 7.9. Hmm that seems high but it's the formula. Actually let me recheck: for A:H, ISCBase = 0.56, Impact sub score = 6.42 × 0.56 = 3.5952. Scope unchanged: Impact = 6.42 × (ISCBase - 0.029) - 3.25×(ISCBase-0.02)^15 = 6.42×0.531 - 3.25×(0.54)^15. (0.54)^15 is tiny → ~0. So 3.409? Wait no. Formula: Impact = 6.42 × ISS where ISS = 1 - [(1-C)(1-I)(1-A)]. With C:N, I:N, A:H → ISS = 1 - (1)(1)(1-0.56) = 0.56. Then for scope unchanged: Impact = 6.42 × ISS = 3.5952. Hmm, that's the scope-changed formula variant? Let me recall CVSS 3.1 spec: If Scope is Unchanged: Impact = 6.42 × ISS. If Scope Changed: Impact = 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15. Yes, so 3.5952 for unchanged. So base = min(Impact+Exploitability,10) × 1.08 = min(7.927,10)=7.927 → 7.927 × 1.08 = 8.561 → roundup = 8.6? No wait — the 1.08 multiplier is for Scope
An out-of-bounds write in FreeRDP's urbdrc (USB redirection) client channel allows a malicious or compromised RDP server to crash the connecting client. When the client loads the urbdrc channel, a crafted 28-byte USB redirection message drives urb_send_current_frame_number_result() to write 4 bytes past a 16-byte heap buffer, which trips an assertion (CWE-617) and terminates the process on builds with verbose asserts enabled. The flaw affects FreeRDP 3.14.0 through 3.30.0 and is fixed in 3.31.0; impact is availability only, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Let me produce the JSON. Key facts: - CVE-2026-91950, FreeRDP before 3.31.0 - OOB read in rdpdr_dump_packet due to 32-bit unsigned integer wraparound in buffer bounds validation - computerNameLen = 0xFFFFFFF0 bypasses bounds check → OOB read → client crash or heap disclosure in logs - CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-125 - VulnCheck reported - CPE: freerdp:freerdp all versions (up to before 3.31.0) - Tags: Buffer Overflow, Information Disclosure, Freerdp - References: GitHub security advisory GHSA-c5gr-hmqp-pwj4, VulnCheck advisory No EPSS, no KEV, no POC mentioned. Attack requires the client to connect to a malicious RDP server — UI:P (passive user interaction: the user connects to the server). PR:N. No privileges. AV:N because the malicious server is remote. Exploitation conditions: attacker must control/operate the RDP server the client connects to; requires the RDPDR (device redirection) virtual channel to be enabled/active — in FreeRDP, rdpdr is used for drive/printer/port redirection and is typically negotiated when the client has redirection enabled. Also the dump/log path (rdpdr_dump_packet is a debug dump function) — so triggering the crash likely requires the rdpdr debug logging/dump enabled? Hmm. The function rdpdr_dump_packet is a dumping function, likely compiled when WITH_DEBUG_RDPDR or verbose logging is enabled. Actually in FreeRDP, rdpdr_dump_packet exists in rdpdr_main.c guarded by... let's be careful. I'd say the OOB read occurs during packet dump/parsing on logging, so higher log verbosity may be required. I should state this as an inference and flag uncertainty. Remediation: upgrade to FreeRDP 3.31.0 or later; advisory link. Workarounds: disable device redirection (rdpdr), avoid connecting to untrusted RDP servers, reduce log verbosity, remove /drive /printer flags. Trade-offs. Prevalence: FreeRDP is widely deployed as the RDP client in Linux distros, ThinLinc, etc. — high (widely depl
Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.
Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
FreeRDP deployments running the RDPGFX server-side graphics pipeline before version 3.31.0 leak uninitialized heap memory to any authenticated RDP client, because the ResetGraphics PDU serializer leaves the padding bytes of its fixed 340-byte wire structure untouched. The leaked bytes can contain live heap pointers and GLib function addresses, which defeats heap ASLR and reveals the GLib module base address — a strong primitive for chaining into further memory-corruption exploits. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, though the fix commit is publicly visible, making the flaw trivially reverse-engineerable.
The user wants a JSON analysis. Let me note the details. CVE-2026-91945: FreeRDP before 3.31.0, OOB read in smartcard response decoders failing to validate ATR length fields. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses. CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CWE-125. Patch available from vendor, commit 9626564421df72c84f891afdbc0b20bf702f369f. Reported by VulnCheck. Note: the commit diff shown appears unrelated to the actual fix (CMakeLists.txt winpr change) — that's a data quality flag potentially. Actually the diff snippet seems to be CMake version check — not the actual security fix. Hmm. Could mention in confidence notes as suspicious/mismatched patch reference. But careful — the diff is truncated; only showing part. I could flag it. Tags: Buffer Overflow, Information Disclosure, Freerdp. "Buffer Overflow" is arguably a mislabel — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag could be considered mislabeled. That's a plausible data_quality_flag: mislabeled_tag target "Buffer Overflow", suggested "out-of-bounds-read". Confidence medium. Actually the instructions say only emit flag when clearly wrong and verifiable from references. CWE-125 out-of-bounds read is a memory read, not a classic buffer overflow (CWE-120/787 write). Description explicitly says "out-of-bounds read" causing process termination. So the "Buffer Overflow" tag is misleading. I'd emit a medium-confidence flag. Also "freerdp" tag present as "Freerdp" — it's lowercase normalized presumably fine. Missing tags? Possibly "smartcard"? Not a standard tag. Maybe "cwe-125"? Not necessarily. I'll skip missing tags. Prevalence: FreeRDP is a widely used open-source RDP client library — high? It's used in many Linux distributions, thin clients, etc. I'd say "high" or "medium". FreeRDP is the de facto open source RDP implementation, bundled in distros, used by ma
Uninitialized heap memory disclosure in FreeRDP 3.0.0-3.30.0 exposes up to 576 bytes of stale server or proxy heap contents - potentially including cleartext credentials from prior RDP sessions - to any authenticated downstream RDP client. Three PDU-serialization functions in libfreerdp/core/info.c advance the stream write pointer with Stream_Seek over reserved padding bytes instead of zeroing them with Stream_Zero, leaving prior malloc heap contents in Save Session Info PDUs transmitted to clients. FreeRDP-based server deployments and freerdp-proxy instances are the affected roles; a vendor-confirmed fix ships in version 3.31.0, and no public exploit or active exploitation has been identified at time of analysis.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. No public exploit has been identified at time of analysis, but the confirmed heap write primitive and RCE classification make this a credible code execution risk for susceptible client builds connecting to untrusted servers.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Server-side authentication bypass in FreeRDP 3.x (confirmed through 3.27.1) allows an unauthenticated remote attacker to obtain a fully authenticated RDP session without supplying any credentials, GUID, or reconnect cookie when the server has RdstlsSecurity enabled. The flaw combines PDU-type confusion - the server routes inbound messages based solely on the client-supplied wire pduType without enforcing handshake state - with a calloc-zeroed result code that maps directly to RDSTLS_RESULT_SUCCESS, so sending a Capabilities PDU in place of the required Authentication Request PDU produces an unconditional authentication success response. No public exploit code or CISA KEV listing has been identified at time of analysis; the upstream fix commit is confirmed but a released patched version was not independently verified at advisory time.
Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Integer overflow in FreeRDP's audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends affects all versions before 3.29.0, exploitable by a malicious or compromised RDP server. The server can supply a crafted FramesPerPacket value that causes allocation size wraparound, leading to a heap-based buffer overflow on Linux/ALSA - potentially enabling code execution - or denial of service on all supported platforms. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; vendor-released patch (3.29.0) is available.
Heap-based buffer overflow in FreeRDP's Windows clipboard client (versions ≤ 3.29.0) allows a malicious or compromised RDP server to write attacker-controlled data beyond the bounds of a paste consumer's heap allocation. The flaw in CliprdrStream_Read trusts the server-supplied response length (req_fsize) rather than the caller-supplied buffer bound (cb), so any OLE paste consumer such as explorer.exe that calls IStream::Read against server-offered clipboard file contents can have its heap corrupted. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and a fix is available in FreeRDP 3.30.0.
Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.
Heap out-of-bounds read in FreeRDP's glyph cache subsystem (versions <= 3.28.0) allows a malicious or compromised RDP server to crash any connecting FreeRDP client by sending a GLYPH_FRAGMENT_ADD update with a server-controlled declared fragment size that exceeds the actual received buffer. The vulnerability exists because update_process_glyph_fragments() and glyph_cache_fragment_put() in libfreerdp/cache/glyph.c read a one-byte declared size and proceed to allocate and copy that many bytes without first validating that the declared size fits within the remaining data in the received packet. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with AV:N/AC:L/PR:N reflects trivial remote exploitation requiring only a client connection to a rogue server.
Heap use-after-free in FreeRDP's asynchronous update message proxy (all versions before 3.29.0) enables a malicious or compromised RDP server to crash the connecting client or induce memory corruption by sending crafted RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER update packets. The vulnerability surfaces only when the AsyncUpdate option is enabled on the client, limiting but not eliminating real-world exposure given the feature's performance benefits and common usage. Vendor-released patch version 3.29.0 is available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap use-after-free in FreeRDP's async update message proxy allows a malicious or compromised RDP server to crash the client and corrupt heap memory through a crafted RAIL WINDOW_ORDER_ICON message. The flaw is gated on the AsyncUpdate feature being explicitly enabled via the /async-update flag - a non-default client configuration - which limits real-world exposure relative to the CVSS 4.0 score of 8.7. All FreeRDP versions prior to 3.29.0 (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.
Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
TLS server certificate purpose validation bypass in FreeRDP before 3.29.0 allows a trusted, hostname-matching certificate issued only for client authentication (clientAuth EKU) to be accepted as a valid RDP server certificate. This weakens the trust model in environments that rely on Extended Key Usage separation between client and server certificates, enabling an attacker who can present such a certificate to impersonate the RDP server. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and not listed in CISA KEV.
Denial of service in FreeRDP before 3.29.0 allows any unauthenticated network-reachable RDP client to exhaust server memory by sending a crafted RDPEI PDU with a large declared body length and no corresponding body data. The RDPEI server channel handler allocates a stream buffer sized to the attacker-controlled length field without first validating it against any maximum, making exploitation trivially repeatable. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the unauthenticated pre-auth vector (CVSS 4.0 PR:N, AV:N, AC:L) and 8.7 score indicate meaningful priority for deployments running FreeRDP in server mode.
Null pointer dereference in FreeRDP's smartcard virtual channel allows remote unauthenticated attackers to crash the process by sending malformed smartcard IRP (I/O Request Packet) requests. All FreeRDP releases before 3.29.0 are affected: crafting an IRP with a non-zero cReaders field but truncated reader-state payload causes the decoder to fail, after which the free_reader_states cleanup function dereferences a null pointer and terminates the session. Impact is limited to denial of service - no confidentiality or integrity compromise is possible. No public exploit code or CISA KEV listing identified at time of analysis.
TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.
Memory exhaustion in FreeRDP before 3.29.0 allows unauthenticated attackers controlling a malicious RD Gateway endpoint to crash the client by sending Transfer-Encoding: chunked HTTP response bodies of unbounded size. The `http_response_recv_body()` function fails to enforce the configured `RESPONSE_SIZE_LIMIT` exclusively for chunked responses, creating an exploitable gap in the intended safety boundary. No active exploitation (CISA KEV) or public POC has been identified, but the CVSS 4.0 score of 8.7 reflects the low attack complexity once an attacker can serve a malicious gateway response.
Out-of-bounds read in FreeRDP's async update message proxy exposes clients to memory disclosure or process crash when connecting to a malicious or compromised RDP server with AsyncUpdate enabled. The flaw is in update_message_PolygonSC() and update_message_PolygonCB(), which allocate a fresh points array but copy data from the enclosing order structure's base address rather than from the correct ->points member, reading adjacent heap memory. All FreeRDP versions before 3.29.0 are affected; no CISA KEV listing and no public exploit code exist at time of analysis.
TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap-based remote code execution in the FreeRDP Windows client (all versions before 3.29.0) is triggered when a user pastes clipboard content sourced from a malicious RDP server. The client fails to validate the server-supplied data size in CLIPRDR_FILE_CONTENTS_RESPONSE PDUs against the destination buffer, allowing an oversized payload to corrupt heap memory. A publicly available vendor advisory (GHSA-cj9v-h4hq-29jr, reported by VulnCheck) documents the flaw; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap out-of-bounds read in FreeRDP's TSMF FFmpeg decoder allows a malicious RDP server to crash connecting client processes by sending malformed AVC1 MPEG2VIDEOINFO media type data with undersized ExtraData buffers. All FreeRDP releases prior to 3.29.0 are affected (CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*), with the root cause being fixed-offset heap reads in the media format parser that proceed without validating source buffer length - a CWE-125 pattern. No CISA KEV listing or public exploit code has been identified at time of analysis; the vendor has released a patch at version 3.29.0 and the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity consequence per the provided vector.
Argument injection in FreeRDP before 3.28.0 lets a malicious .rdp connection file smuggle arbitrary command-line options into the client, because any line beginning with a forward slash is passed straight to the CLI parser rather than treated as an RDP setting. An attacker who convinces a victim to open a crafted RDP file can invoke options such as /rdp2tcp (command execution), /cert:ignore (certificate-validation bypass), or /drive (local filesystem exposure) the moment the file is opened. There is no public exploit identified at time of analysis, but the fix is published (3.28.0) alongside a coordinated VulnCheck and GitHub security advisory.
Client-side double-free (CWE-415) in FreeRDP's .rdp connection-file parser lets an attacker who tricks a victim into opening a malicious .rdp file corrupt heap memory, potentially leading to a crash or code execution in xfreerdp/sdl-freerdp/wlfreerdp. The flaw is in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c), where a non-owning pointer to the settings-owned MonitorIds array is freed on a strtoul error path without clearing settings->MonitorIds, so freerdp_settings_free() frees the same buffer again at teardown. All 3.x releases through 3.27.1 are affected in the default configuration and it is fixed in 3.28.0; there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided.
Denial of service in FreeRDP servers (versions <=3.27.1) allows unauthenticated remote attackers to crash the service by forging a malicious encrypted client random during RDP Standard Security negotiation. Because the server publishes its RSA public key, an attacker can craft a ciphertext whose decrypted plaintext spans the full RSA modulus (up to 256 bytes for RSA-2048), overflowing a fixed 32-byte heap buffer in crypto_rsa_common() by roughly 224 attacker-controlled bytes before any authentication occurs. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix landed in FreeRDP 3.28.0.
An off-by-one out-of-bounds read in the FreeRDP glyph cache (CWE-125) allows a malicious or compromised RDP server to trigger a memory access past the end of the cached glyph entries array in FreeRDP clients before version 3.27.0. Exploitation requires the victim to initiate an outbound RDP connection to the attacker-controlled server (UI:R), but no authentication is required (PR:N), and default client configurations are exposed because glyph caching is standard RDP functionality. The flaw can crash the client (A:H) and cause limited memory disclosure (C:L); EPSS is low at 0.37% (30th percentile) and no public exploit code or CISA KEV confirmation was identified at time of analysis.
Heap-based buffer overflow in FreeRDP (the widely used open-source RDP client library) allows a malicious or compromised RDP server to corrupt client memory and potentially achieve remote code execution in the connecting client's context. The flaw lives in the primary drawing-order parser (update_read_delta_points in libfreerdp/core/orders.c), where an inverted integer-overflow guard let an attacker-controlled point count produce an undersized heap allocation followed by an out-of-bounds write. No public exploit identified at time of analysis; the issue is fixed in FreeRDP 3.28.0 (GHSA-v5wf-j8j4-77h7).
## Summary Remote code execution and denial of service in FreeRDP before 3.22.0 stem from a use-after-free in the dynamic virtual channel manager (drdynvc), where `dvcman_channel_close` and `dvcman_call_on_receive` access `channel_callback` without proper synchronization (CWE-362). A malicious or compromised RDP server can race DYNVC_DATA and DYNVC_CLOSE messages to free a channel callback while another thread still uses it, corrupting the client heap. This is a client-side flaw affecting anyone connecting to an attacker-controlled server; no public exploit identified at time of analysis, and it is not listed in CISA KEV. ## Technical Context FreeRDP is a widely used open-source implementation of the Microsoft Remote Desktop Protocol, embedded in clients such as Remmina, GNOME Connections, Weston, and numerous commercial and VDI products. The bug lives in the drdynvc (Dynamic Virtual Channel) subsystem, which multiplexes optional channels (clipboard, audio, device redirection, etc.) over the RDP connection and processes them on a dedicated client thread. Per CWE-362 (concurrent execution using shared resource with improper synchronization / race condition), `dvcman_channel_close` (handling DYNVC_CLOSE) can free the `channel_callback` structure while `dvcman_call_on_receive` (handling DYNVC_DATA) is concurrently dereferencing it, producing a heap use-after-free. Because the RDP server dictates the timing and ordering of DYNVC_DATA and DYNVC_CLOSE PDUs, a hostile server controls the race window. ## Risk Assessment The published CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H) yields 8.3 (High), driven mainly by high availability impact with lower confidentiality/integrity impact — consistent with a heap corruption that reliably crashes the client (DoS) but only potentially yields RCE. AC:H correctly reflects that success depends on winning a non-deterministic thread race, which is unreliable and may require many attempts. There is no EPSS score, no KEV listing, and no confirmed public POC in the provided data, so exploitation pressure is currently low-to-unknown; the RCE and Denial Of Service tags reflect potential impact, not observed attacks. One nuance to verify: the vector uses UI:N/PR:N, but this is a client-side vulnerability requiring the victim to connect to a malicious server — a real-world limiting factor that raw CVSS understates. Net: a legitimate patch priority for fleets whose users connect to untrusted or reachable RDP endpoints, but not an emergency mass-exploitation scenario given AC:H and no evidence of exploitation. ## Affected Products FreeRDP (the open-source RDP client/library and its FreeRDP-based clients) at all versions prior to 3.22.0 are affected; the flaw is fixed in FreeRDP 3.22.0. No CPE strings were provided in the input, so exact downstream package ranges (e.g., distribution builds of Remmina or the freerdp2/freerdp3 packages) should be confirmed against vendor trackers. Authoritative details are in the FreeRDP GitHub Security Advisory GHSA-3mv2-5q57-2v8h (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h) and the VulnCheck advisory (https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback). ## Remediation Vendor-released patch: FreeRDP 3.22.0 — upgrade all FreeRDP libraries and any FreeRDP-based clients (Remmina, GNOME Connections, xrdp clients, etc.) to 3.22.0 or later, rebuilding or updating downstream distribution packages that bundle the library. Until patched, reduce exposure by only connecting to trusted, known-good RDP servers and avoiding connections to untrusted or attacker-influenced hosts, since the malicious behavior originates server-side; where feasible, restrict outbound RDP (TCP 3389) from client machines to an allowlist of approved servers via egress firewall rules (trade-off: breaks ad-hoc connections to new servers). If specific dynamic virtual channels are not required, disabling optional channel redirections (clipboard, drive, audio) narrows the attack surface of drdynvc but does not fully eliminate the race and reduces functionality. Follow guidance in GHSA-3mv2-5q57-2v8h (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h) and the VulnCheck advisory (https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback). ## Exploit Scenario An attacker stands up or compromises an RDP server and lures a victim into connecting with a vulnerable FreeRDP client (e.g., via a malicious .rdp file, phishing link, or a man-in-the-middle position). Once connected, the server rapidly interleaves DYNVC_DATA and DYNVC_CLOSE messages on a dynamic virtual channel to win the race and trigger the heap use-after-free in the client's drdynvc thread, crashing the client or, with careful heap grooming, potentially executing code in the client process. No public POC is identified at this time, and the AC:H race condition makes reliable code execution difficult. ## Exploitation Conditions Exploitation requires the victim to establish an RDP session to an attacker-controlled or compromised server running against a FreeRDP client before 3.22.0, and the connection must use the drdynvc dynamic virtual channel path. The attacker must then concurrently send DYNVC_DATA and DYNVC_CLOSE messages on a dynamic virtual channel to win a timing race in `channel_callback` access. Limiting factors: the attacker must control the RDP server side (this is a client-side vulnerability, so it cannot be triggered against an unwilling client that never connects), the exploit depends on winning a non-deterministic thread race (CVSS AC:H) so it is unreliable and may require repeated attempts, and reliable code execution beyond a crash requires heap-layout control. No authentication to the malicious server is needed, but the user must initiate the outbound connection. ## Attack Chain Lure victim to malicious RDP server → Client opens dynamic virtual channel (drdynvc) → Server races DYNVC_DATA and DYNVC_CLOSE → Trigger heap use-after-free on channel_callback → Crash client or execute code in client process ## Confidence Notes Affected/fixed version (before 3.22.0; fixed in 3.22.0), root cause, and functions are confirmed by the FreeRDP GitHub Security Advisory GHSA-3mv2-5q57-2v8h and the VulnCheck advisory. CVSS 4.0 vector, 8.3 score, and CWE-362 are provided in the input; RCE is described as potential, not demonstrated. Not listed in CISA KEV and no EPSS score or public POC was provided, so real-world exploitation status is unknown; downstream package version ranges are not confirmed due to absent CPE data. ## Prevalence high ## Prevalence Basis core open-source RDP library embedded in many Linux remote-desktop clients ## Assessed CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H ## Assessed CVSS Rationale Client-side flaw needing the victim to connect to a malicious server (UI:R) and to win a thread race (AC:H); heap corruption gives high availability impact with limited C/I. ## Assessed CVSS 4.0 Vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Out-of-bounds heap write in FreeRDP versions prior to 3.26.0 allows remote attackers to corrupt memory in the planar bitmap decoder when an RDP client connects to a malicious or compromised server. The flaw lives in freerdp_bitmap_decompress_planar() in libfreerdp/codec/planar.c, where attacker-controlled stride and X-destination values bypass bounds checks against the internal pTempData buffer. No public exploit identified at time of analysis, but the issue is fixed upstream in 3.26.0.
Heap buffer overflow write in FreeRDP's server-side clipboard (cliprdr) channel allows a malicious RDP client to crash server processes and potentially achieve remote code execution against FreeRDP versions prior to 3.26.0. The flaw is triggered by a malformed CB_CLIP_CAPS PDU with an undersized capabilitySetLength field, corrupting heap memory after authentication. No public exploit identified at time of analysis, but the CVSS 8.8 rating and heap corruption nature make this a high-priority patch for any RDP server deployment using FreeRDP.
Heap use-after-free/double-free in the FreeRDP RDP client (versions prior to 3.26.0) lets a malicious or compromised RDP server corrupt client memory through the RDPEAR authentication-redirection path. The flaw stems from the RDPEAR NDR parser reusing a single non-null pointer ref-id across multiple logical fields, causing the same heap object to be assigned to two outputs and freed twice by the generic destructor. There is no public exploit beyond a proof-of-concept (SSVC: poc), and EPSS exploitation probability is very low (0.05%), but the SSVC technical impact is rated total and a vendor fix is available.
Heap buffer overflow write in FreeRDP client versions prior to 3.26.0 allows a malicious RDP server to corrupt client memory and potentially achieve code execution when the victim connects with RDPGFX enabled. The flaw resides in gdi_CacheToSurface, where validation uses a clamped destination rectangle while the actual copy uses unclamped cacheEntry width/height values, enabling a large out-of-bounds heap write. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer overflow in FreeRDP versions prior to 3.26.0 allows a malicious RDP server to write out-of-bounds heap memory on connecting clients through the gdi_CacheToSurface function, potentially leading to remote code execution or client crash. The flaw stems from inconsistent rectangle validation where coordinates are clamped to UINT16_MAX but copy operations use unclamped cache entry dimensions. Publicly available exploit code exists per SSVC, though EPSS exploitation probability remains low at 0.06%.
Heap buffer overflow in FreeRDP's persistent bitmap cache handling allows local attackers to corrupt memory integrity and crash the RDP client. Affecting all versions prior to 3.24.2, the vulnerability (CWE-122) occurs when memory reallocation fails but the buffer size variable is prematurely updated, creating a size/pointer mismatch. EPSS data not available, but marked medium priority by Ubuntu. No public exploit identified at time of analysis, though technical details are disclosed in the GitHub Security Advisory.
Heap buffer overflow in FreeRDP's H.264 YUV decoder (versions before 3.24.2) allows remote attackers to potentially achieve code execution via specially crafted RDP sessions. The vulnerability stems from premature dimension updates in yuv_ensure_buffer() that persist when memory reallocation fails, creating exploitable memory corruption conditions. Attack requires user interaction (connecting to malicious RDP server) and moderate complexity (CVSS AC:H). No public exploit identified at time of analysis, though CVSS 7.5 HIGH score reflects potential for complete system compromise (C:H/I:H/A:H).
Heap buffer overflow in FreeRDP's CLEAR codec implementation allows remote attackers to execute arbitrary code when processing malicious RDP server responses. Affects all FreeRDP versions prior to 3.24.2. Attack requires high complexity and user interaction (victim must connect to attacker-controlled RDP server), but no authentication is required. CVSS 7.5 reflects the network-accessible attack vector with potential for complete system compromise. No public exploit identified at time of analysis, though technical details are publicly disclosed via GitHub security advisory.
Heap-buffer-overflow in FreeRDP's winpr_aligned_offset_recalloc() function allows local attackers with no privileges but requiring user interaction to trigger high-severity information disclosure and denial of service in versions prior to 3.24.2. The vulnerability involves a READ operation at 24 bytes before heap allocation boundaries (CWE-125: Out-of-bounds Read). Vendor-released patch version 3.24.2 available via GitHub commit a48dbde2c8. EPSS data not provided; no public exploit identified at time of analysis. Affects all FreeRDP installations below 3.24.2, tracked across 7 Debian releases.
Heap buffer overflow in FreeRDP's NSCodec surface-bits handler (versions prior to 3.24.0) lets a malicious or compromised RDP server corrupt heap memory on connecting clients. The gdi_surface_bits() path passes server-supplied bmp.width and bmp.height into nsc_process_message() without validating them against the actual desktop dimensions, and because the attacker also controls the decoded pixel data, the out-of-bounds write can overwrite adjacent heap allocations with attacker-chosen bytes - a potential path to remote code execution. EPSS is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
FreeRDP versions prior to 3.23.0 contain an incomplete fix for a heap-use-after-free vulnerability that affects only the SDL2 code path, where freed memory pointers are not properly nulled, allowing an unauthenticated attacker to trigger a denial of service condition. Users running FreeRDP with SDL2 backends remain vulnerable despite the advisory claiming the issue was resolved. Upgrade to version 3.23.0 or later to obtain the complete fix.
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 8.8 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 8.8 HIGH]