CVE-2026-109253

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

CVE-2026-109251

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting wi...

CVE-2026-109248

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr and countspecialchars calls without a NUL-termination guarantee. A malicious RDP server...

CVE-2026-109243

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2026-109257 FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the...

EUVD-2026-97701

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the...

CVE-2026-109257

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the...

CVE-2026-109257

FreeRDP versions before 3.32.0 are susceptible to a double-free vulnerability within the nsc_context_initialize_encode() function. The root cause is a partial buffer growth failure that leaves dangling plane pointers. An attacker can exploit this by using a crafted RDP client to negotiate NSCodec...

CVE-2026-109257

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the...

CVE-2026-109257 FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the...

CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP versions 3.10.0 through 3.32.2 are vulnerable to a heap buffer overflow within the WinPR png_write_data callback. The root cause is a failure to handle a realloc failure , which allows a malicious RDP clipboard peer to trigger an out-of-bounds memcpy by supplying a large CF_DIB image duri...

CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

EUVD-2026-97700

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

EUVD-2026-97699

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a heap buffer overflow caused by an integer truncation vulnerability in license_check_stream_length. A malicious RDP server can exploit this by sending a crafted SERVER_LICENSE_REQUEST with a large scopeCount, which bypasses existing length c...

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109254

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to...

CVE-2026-109255

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...