PT-2026-22018

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the RLE planar decode path within the planar decompress plane rle function, where it writes to memory without proper...

PT-2026-2931

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw in RDPEAR’s NDR array reader. The NDR array reader does not validate the element count, potentially leading to a heap...

PT-2026-2932

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A heap-buffer-overflow can occur in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound. This allows an oversized re...

PT-2026-3458

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description A heap buffer overflow exists in the RDPGFX ClearCodec decode path when processing maliciously crafted residual data, leading to out-of-bounds writes during color output. This can cause a...

PT-2026-3460

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description The issue is a buffer overflow in the Glyph Alloc function of the FreeRDP Remote Desktop Protocol client. The FastGlyph parsing component trusts the cbData/remaining length and does not validate it...

PT-2026-25167

Name of the Vulnerable Software and Affected Versions systemd affected versions not specified Description The systemd-machined service has an issue with access control due to inadequate validation of the class parameter within the RegisterMachine D-Bus method. A local user with limited privileges...

PT-2026-22017

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description A malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline, such as xfreerdp. This occurs when sending an RDPGFX ClearCodec surface command with an...

PT-2026-3456

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. In ClearCodec, when glyphData is present, the clear decompress function calls freerdp image copy no overlap without validating the...

PT-2026-2930

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A malicious RDP server can cause a heap-buffer-overflow write in the FreeRDP client when processing Audio Input AUDIN format lists. The audin process formats function reuses the callback-formats cou...

PT-2026-7035

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to audio format handling. Specifically, the AUDIN format renegotiation process can lead to a use-after-free condition. This...

PT-2026-7043

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw in the RDPSND async playback thread. Specifically, the thread may process queued Protocol Data Units PDUs after the channel is clos...

PT-2026-22003

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.11.8 FreeRDP versions prior to 3.23.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains an out-of-bounds read issue in the FreeRDP client’s RDPGFX channel. A malicious RDP server ca...

PT-2026-22012

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the xf AppUpdateWindowFromSurface function where a cached XImage’s data pointer can reference a freed RDPGFX surface...

PT-2026-22009

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.23.0 contain a flaw where the xf SetWindowMinMaxInfo function improperly dereferences a freed xfAppWindow pointer...

PT-2026-2929

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw due to a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread. This condition...

PT-2026-29139

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. In versions prior to 3.24.2, the yuv ensure buffer function within libfreerdp/codec/h264.c updates h264-width and h264-height before...

PT-2026-22020

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists where the rail window free function dereferences a freed xfAppWindow pointer during HashTable Free cleanup. This occurs...

PT-2026-25897

Name of the Vulnerable Software and Affected Versions Ubuntu 16.04 LTS affected versions not specified Ubuntu 18.04 LTS affected versions not specified Ubuntu 20.04 LTS versions prior to 2.67.1+20.04ubuntu1esm1 Ubuntu 22.04 LTS affected versions not specified Ubuntu 24.04 LTS versions prior to...

PT-2026-3455

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. The freerdp bitmap decompress planar function does not properly validate the nSrcWidth and nSrcHeight parameters against...

PT-2026-3459

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a client-side heap buffer overflow in the ClearCodec bands decode path. Crafted band coordinates can cause writes beyond the...