CVE-2026-63633

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

CVE-2026-63652 FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-63652 FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-63652

FreeRDP prior to 3.28.0 contains a double-free vulnerability in rdpsnd_server_recv_formats (the rdpsnd audio channel). An authenticated RDP client can send a malformed Client Audio Formats PDU that causes the server to free context->client_formats without clearing the owning pointer, leading t...

CVE-2026-63652

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

EUVD-2026-62671

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-55194

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194

In FreeRDP before 3.27.0, the function rpc_client_recv_fragment() in libfreerdp/core/gateway/rpc_client.c grows the reassembly buffer based solely on the server-declared alloc_hint rather than the actual StubLength, so a malicious TS Gateway can trigger a heap-buffer overflow write past the 4096-...

CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55193 FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193 FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP clients using TS Gateway assign a server-controlled max_xmit_frag value (up to 65535) to rpc->max_recv_frag in rpc_bind.c without capping it to the 4088-byte ReceiveFragment buffer, so rpc_channel_read in rpc.c writes up to 65535 bytes, overflowing by up to 61447 attacker-controlled by...

CVE-2026-55564

CVE-2026-55564 is an out-of-bounds heap read in FreeRDP (a free RDP client implementation) affecting versions prior to 3.27.0 . The root cause is in glyph_cache_get() in libfreerdp/cache/glyph.c, which uses > instead of >= when bounds-checking the index against cache->number. A malicious...

CVE-2026-55564 FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...

CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...