CVE-2026-109254

A flaw was found in FreeRDP. A use-after-free vulnerability allows a malicious Remote Desktop Protocol RDP server to cause a Denial of Service DoS by crashing the client. During static audio channel disconnection, audio data structures are released before the background playback thread finishes...

CVE-2026-109255

A flaw was found in FreeRDP. An integer truncation issue in license stream length validation allows a malicious Remote Desktop Protocol RDP server to bypass size checks by sending a specially crafted licensing request. This flaw leads to an undersized memory allocation and a heap-based buffer...

CVE-2026-109252

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending truncated authentication data to a connecting client. During error handling of the incomplete response, the client attempts to access uninitialized memory, leading to an...

CVE-2026-109248

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a heap out-of-bounds read by returning a specially crafted response during clipboard operations. When a user attempts to paste files copied from the remote session into a local application, improper handling o...

CVE-2026-109676: Use After Free

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109952: Selection of Less-Secure Algorithm During Negotiation

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in negoprocessnegotiationresponse, allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla...

CVE-2026-109947: Allocation of Resources Without Limits or Throttling

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on...

CVE-2026-109942: NULL Pointer Dereference

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...

CVE-2026-109938: Integer Overflow or Wraparound

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791568721)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791568721 advisory. - FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the...

PT-2026-111537

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.3.0 through 3.31.0 Description An issue exists where the software dereferences a NULL stream in the rdg process close packet function within libfreerdp/core/gateway/rdg.c. This occurs because the rdg process control packet...

PT-2026-111541

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.11.0 through 3.31.0 Description The software fails to validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion. This allows a malicious or compromised RDP server to terminate a connected client by...

CVE-2026-109943: Double Free

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109945: Concurrent Execution using Shared Resource with Improper Synchronization

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109949: Improper Restriction of Excessive Authentication Attempts

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset...

CVE-2026-109944: Reachable Assertion

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

CVE-2026-109939: NULL Pointer Dereference

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

PT-2026-111542

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.20.1 through 3.31.0 Description An uncontrolled resource allocation issue exists where malicious RDP servers can exhaust client memory through oversized drive redirection read requests. This occurs when an attacker sends an...

PT-2026-111547

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The client fails to verify server-selected PROTOCOL RDSTLS or PROTOCOL HYBRID EX against the enabled protocol set within the nego process negotiation response function. This flaw allows a...

CVE-2026-109953: Insufficiently Protected Credentials

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...