PT-2026-3457

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description A client-side heap buffer overflow exists in the FreeRDP client’s gdi SurfaceToSurface path. This occurs due to a mismatch between destination rectangle clamping and the actual copy size. A maliciou...

PT-2026-7042

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to the ainput send input event function. This function caches a channel callback in a local variable and subsequently uses ...

PT-2026-3458

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description A heap buffer overflow exists in the RDPGFX ClearCodec decode path when processing maliciously crafted residual data, leading to out-of-bounds writes during color output. This can cause a...

PT-2026-29140

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an issue exists in the persistent cache read entry v3 function within libfreerdp/cache/persistent.c...

PT-2026-29135

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.24.2 contain a heap-buffer-overflow READ vulnerability. This issue occurs due to a 24-byte buffer overflow before...

PT-2026-29133

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. An unvalidated auth length field read from the network triggers a WINPR ASSERT failure in the rts read auth verifier no checks...

PT-2026-22009

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.23.0 contain a flaw where the xf SetWindowMinMaxInfo function improperly dereferences a freed xfAppWindow pointer...

PT-2026-29134

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol RDP server can cause a FreeRDP client to crash by sending audio data in IMA ADPCM format with an...

PT-2026-22016

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description A missing bounds check in the smartcard unpack read size align function within libfreerdp/utils/smartcard pack.c can cause the FreeRDP client to crash when connecting to a malicious RDP server. This...

PT-2026-7041

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the audin server recv formats function incorrectly calculates the number of audio formats to free upon parse failure...

PT-2026-25333

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A client-side heap out-of-bounds read/write issue exists in FreeRDP's bitmap cache subsystem. This is due to an incorrect boundary...

PT-2026-25336

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A size t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to a heap-buffer-overflow write via the RDPSND audio channel. T...

PT-2026-25335

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is an implementation of the Remote Desktop Protocol. The gdi surface bits function handles SURFACE BITS COMMAND messages from the RDP server. When using NSCodec, the bmp.width and bmp.height...

PT-2026-25338

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.24.0 contain an out-of-bounds read in the MS-ADPCM and IMA-ADPCM decoders. This issue is caused by unchecked...

PT-2026-22013

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A heap use-after-free condition exists in the clipboard channel due to improper memory management within the xf cliprdr provide data...

PT-2026-22020

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists where the rail window free function dereferences a freed xfAppWindow pointer during HashTable Free cleanup. This occurs...

PT-2026-22010

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the xf AppUpdateWindowFromSurface function where it reads from a freed xfAppWindow. This occurs because the RDPGFX D...

PT-2026-22011

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the RAIL channel window management where the xf rail server local move size function dereferences a freed xfAppWindo...

PT-2026-22004

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function xf rail server execute result indexes the global error code names array with an unchecked value...

SUSE CVE-2025-68118

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP's certificate handling code on Windows platforms. The function freerdpcertificatedatahash uses the Microsoft-specific snprintf function to format certificate cache filenames...