CVE-2026-109944

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109941

FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in httpchunckedread that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads ...

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109680

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername th...

CVE-2026-109953

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-109940

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109677

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...

CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109953

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to an insufficiently protected credentials vulnerability (CWE-522). When using the /restricted-admin option, the software fails to suppress CredSSP credential delegation , causing the application to transmit cleartext passwords to the RDP server...

CVE-2026-109953

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-109952

The FreeRDP client 3.0.0 before 3.32.0 is vulnerable to a security protocol downgrade because it fails to validate server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set within the nego_process_negotiation_response() function. A malicious server or man-in-the-middl...

CVE-2026-109952

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in negoprocessnegotiationresponse, allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla...

CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...