PoC-Exploit

pocs Proof-of-concept exploits for vulnerabilities discovered...

Vulnerability of the rdpsnd_server_recv_formats() function in the channels/rdpsnd/server/rdpsnd_main.c file of the RDP client FreeRDP, which allows a hacker to trigger a service failure

The vulnerability of the rdpsndserverrecvformats function in the channels/rdpsnd/server/rdpsndmain.c file of the RDP client FreeRDP is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the rpc_client_recv_fragment() function in the libfreerdp/core/gateway/rpc_client.c file of the RDP client FreeRDP, allowing a attacker to cause a service failure and execute arbitrary code.

The vulnerability of the rpcclientrecvfragment function in the libfreerdp/core/gateway/rpcclient.c file of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause service failures and execute arbitrary code...

The vulnerability in the libfreerdp/codec/h264.c file of the H.264 decompression subsystem of the RDP client FreeRDP allows a hacker to cause a service failure and expose protected information.

The vulnerability in the libfreerdp/codec/h264.c file of the H.264 decompression subsystem of the RDP client FreeRDP relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to cause service failures and expose sensitive information...

Vulnerability of the freerdp_dsp_decode_opus() function in the libfreerdp/codec/dsp.c file of the RDP client FreeRDP, which allows a hacker to trigger a service denial and execute arbitrary code.

The vulnerability of the freerdpdspdecodeopus function in the libfreerdp/codec/dsp.c file of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure and execute arbitrary code...

CVE-2026-69159

A flaw was found in FreeRDP, an implementation of the Remote Desktop Protocol. A malicious RDP server can exploit an out-of-bounds read vulnerability by sending a malformed planar bitmap or surface update. This causes the client's decoder to read beyond its allocated buffer, which can lead to a...

CVE-2026-63633

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol RDP server can exploit a heap buffer overflow vulnerability during Opus audio decoding. This occurs when the server negotiates Opus audio with a vulnerable client, causing the...

CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

CVE-2026-63652

A flaw was found in FreeRDP. An authenticated Remote Desktop Protocol RDP client can send a specially crafted Client Audio Formats Protocol Data Unit PDU to the server. This malformed PDU can cause a double-free vulnerability in the rdpsndserverrecvformats function, leading to the server reliably...

CVE-2026-55192

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

Linux Distros Unpatched Vulnerability : CVE-2026-63633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls...

CVE-2026-69159

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-69159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in...

UBUNTU-CVE-2026-69159

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-63652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees...

Linux Distros Unpatched Vulnerability : CVE-2026-63117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to ...

CVE-2026-63117

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An authenticated Remote Desktop Protocol RDP client can trigger a denial of service by sending a specially crafted DVI ADPCM frame. By advertising specific nBlockAlign and nChannels values, a division-by-zero error...

CVE-2026-69159

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE-2026-67306. Notes: All CVE users should reference CVE-2026-67306 instead of this candidate...

CVE-2026-63633

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

CVE-2026-63652

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...