SUSE CVE-2026-110834

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

SUSE CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

SUSE CVE-2026-110836

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in httpresponserecv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

SUSE CVE-2026-110837

FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded sampl...

SUSE CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

SUSE CVE-2026-110839

FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...

CVE-2020-11019

CVE-2020-11019 In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. authentication| complexity|...

CVE-2026-110835

A flaw was found in FreeRDP. A remote, unauthenticated attacker can perform HTTP header injection by submitting a routing token containing an unvalidated line feed character to a FreeRDP proxy configured with dynamic targets and an upstream Hypertext Transfer Protocol HTTP proxy. This vulnerabili...

CVE-2026-110834

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending read or write requests for a redirected serial device before the device is opened or after it has been closed. Because FreeRDP does not verify that the serial communication...

CVE-2026-110832

A flaw was found in FreeRDP. An authenticated remote client can trigger excessive memory consumption on the server by sending a crafted Dynamic Virtual Channel DVC message with an arbitrarily large declared length. Because the server immediately allocates and initializes the requested memory befo...

CVE-2026-110831

A flaw was found in FreeRDP. When a client connects to a malicious Remote Desktop Protocol RDP server with drive redirection enabled, the server can send a specially crafted request that triggers an error during file allocation. Because FreeRDP fails to release the opened local file when this...

CVE-2026-110830

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones,...

CVE-2026-110829

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a malformed audio channel rdpsnd fragment to a connecting client. Due to missing validation of packet flags, processing a terminating fragment on an uninitialized channel...

CVE-2026-110836

A flaw was found in FreeRDP. A remote attacker controlling a Remote Desktop gateway can cause a Denial of Service DoS by returning a crafted HTTP response containing an unrecognized Content-Type header with a semicolon and a nonzero Content-Length. This flaw triggers an infinite loop in the...

CVE-2026-110833

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection RDPDR channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous da...

CVE-2026-110838

A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potential...

CVE-2026-110837

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memor...

CVE-2026-110839

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol RDP server to cause client memory corruption and a Denial of Service DoS by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap da...

EUVD-2026-101715

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

EUVD-2026-101717

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...