PT-2026-114146

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0 Description An issue exists in the wts read drdynvc data first function that allows authenticated clients to cause server resource exhaustion. By sending a seven-byte DATA FIRST message on an opened Dynami...

PT-2026-114144

FreeRDP before 3.32.0 fails to close prior serial handles in serial process irp create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP MJ CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD SETSIZE assertio...

PT-2026-114145

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive process irp create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...

PT-2026-114150

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http response recv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

PT-2026-114151

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0 Description A heap-based buffer overflow exists in the freerdp dsp decode mp3 function when the software is built with WITH LAME=ON and WITH DSP FFMPEG=OFF. The issue occurs because the right-channel PCM...

PT-2026-114143

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL FLAG LAST without CHANNEL FLAG FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

PT-2026-114149

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by http proxy connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a...

PT-2026-114148

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP MJ READ or IRP MJ WRITE before create or after close, causing CommReadFile or CommWriteFile to...

Linux Distros Unpatched Vulnerability : CVE-2026-109940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130084 advisory. FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdisurfacebits when processing Surface Bits commands with NSCodec codec ID. A malicious RD...

Linux Distros Unpatched Vulnerability : CVE-2026-109949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the...

Linux Distros Unpatched Vulnerability : CVE-2026-109951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130071)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130071 advisory. FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-109677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count i...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130067)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130067 advisory. FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead o...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130070)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130070 advisory. FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the LBLOADBALANCEINFO field length...

Linux Distros Unpatched Vulnerability : CVE-2026-109947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via...

Linux Distros Unpatched Vulnerability : CVE-2026-109946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion an...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130081 advisory. FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130068)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130068 advisory. FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce...