CVE-2026-109952: Selection of Less-Secure Algorithm During Negotiation

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in negoprocessnegotiationresponse, allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla...

CVE-2026-109947: Allocation of Resources Without Limits or Throttling

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on...

CVE-2026-109942: NULL Pointer Dereference

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...

CVE-2026-109938: Integer Overflow or Wraparound

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

PT-2026-111537

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.3.0 through 3.31.0 Description An issue exists where the software dereferences a NULL stream in the rdg process close packet function within libfreerdp/core/gateway/rdg.c. This occurs because the rdg process control packet...

PT-2026-111541

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.11.0 through 3.31.0 Description The software fails to validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion. This allows a malicious or compromised RDP server to terminate a connected client by...

CVE-2026-109943: Double Free

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109945: Concurrent Execution using Shared Resource with Improper Synchronization

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109949: Improper Restriction of Excessive Authentication Attempts

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset...

CVE-2026-109944: Reachable Assertion

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

CVE-2026-109939: NULL Pointer Dereference

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

PT-2026-111542

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.20.1 through 3.31.0 Description An uncontrolled resource allocation issue exists where malicious RDP servers can exhaust client memory through oversized drive redirection read requests. This occurs when an attacker sends an...

PT-2026-111547

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The client fails to verify server-selected PROTOCOL RDSTLS or PROTOCOL HYBRID EX against the enabled protocol set within the nego process negotiation response function. This flaw allows a...

CVE-2026-109946: Reachable Assertion

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791568721)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791568721 advisory. - FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the...

CVE-2026-109953: Insufficiently Protected Credentials

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-109677: Out-of-bounds Read

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...

CVE-2026-109950: Out-of-bounds Read

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...

PT-2026-111535

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKA ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token...

CVE-2026-109940: Stack-based Buffer Overflow

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...