PT-2026-7034

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw in the urb select interface function. Specifically, the function can free a device’s MS configuration on error, but subsequent code...

PT-2026-3466

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw where the xf Pointer New function incorrectly frees memory associated with cursorPixels both on failure and during norm...

PT-2026-3458

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description A heap buffer overflow exists in the RDPGFX ClearCodec decode path when processing maliciously crafted residual data, leading to out-of-bounds writes during color output. This can cause a...

PT-2026-22016

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description A missing bounds check in the smartcard unpack read size align function within libfreerdp/utils/smartcard pack.c can cause the FreeRDP client to crash when connecting to a malicious RDP server. This...

PT-2026-7038

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the URBDRC client utilizes interface numbers provided by the server as array indices without proper bounds checking. This can...

PT-2026-29137

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a heap buffer overflow exists in the resize vbar entry function located in libfreerdp/codec/clear.c...

PT-2026-2930

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A malicious RDP server can cause a heap-buffer-overflow write in the FreeRDP client when processing Audio Input AUDIN format lists. The audin process formats function reuses the callback-formats cou...

PT-2026-7037

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description A flaw exists in FreeRDP related to handling device channel closures. Specifically, a capture thread may send responses using a callback function after the associated channel has been closed,...

PT-2026-22014

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A heap use after free condition exists in the clipboard handling functionality. Specifically, the xf clipboard format equal function...

PT-2026-3467

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw where offscreen bitmap deletion results in the gdi-drawing pointer referencing freed memory. This creates a...

PT-2026-7033

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the video timer component may send client notifications after the control channel has been closed. This action can lead to a...

PT-2026-7040

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to asynchronous bulk transfer completions. Specifically, the software can utilize a freed channel callback following a URBD...

PT-2026-22009

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.23.0 contain a flaw where the xf SetWindowMinMaxInfo function improperly dereferences a freed xfAppWindow pointer...

PT-2026-22004

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function xf rail server execute result indexes the global error code names array with an unchecked value...

PT-2026-7036

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw in the ecam encoder compress h264 component. The component does not properly validate the source buffer size and relies on dimensio...

PT-2026-7043

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw in the RDPSND async playback thread. Specifically, the thread may process queued Protocol Data Units PDUs after the channel is clos...

PT-2026-3456

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. In ClearCodec, when glyphData is present, the clear decompress function calls freerdp image copy no overlap without validating the...

PT-2026-7042

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to the ainput send input event function. This function caches a channel callback in a local variable and subsequently uses ...

PT-2026-25336

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A size t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to a heap-buffer-overflow write via the RDPSND audio channel. T...

PT-2026-25334

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. An integer underflow exists in the update read cache bitmap order function within FreeRDP's Core Library. Recommendations Update to...