CVE-2026-67296 FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67304 FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...

CVE-2026-67296 FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67296

CVE-2026-67296 affects FreeRDP prior to 3.29.0, where the RDPEI server channel handler may allocate excessive memory if a header-only RDPEI message declares a large body length, enabling a denial-of-service. This is documented in the NVD/CVE entries and CVE listing; no patch details are provided ...

CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

EUVD-2026-51840

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

EUVD-2026-51857

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

CVE-2026-67293 FreeRDP before 3.29.0 Improper Certificate Hostname Validation

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67297

FreeRDP prior to 3.29.0 contains a flaw in http_response_recv_body() where RESPONSE_SIZE_LIMIT is not enforced for Transfer-Encoding: chunked HTTP responses. This allows an attacker controlling a malicious RD Gateway endpoint to send oversized chunked bodies, exhausting memory on the client. Impa...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Linux Distros Unpatched Vulnerability : CVE-2026-64624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted...

CVE-2026-64620

A heap-based buffer overflow in FreeRDP's cryptorsacommon allows an unauthenticated remote attacker to trigger a denial of service or potential remote code execution. By sending a crafted ciphertext during RDP Standard Security key establishment, the attacker can force a data write before the siz...

EUVD-2026-46118

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

UBUNTU-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

CVE-2026-64624 affects FreeRDP prior to 3.28.0. The issue arises because lines starting with a forward slash in RDP files are treated as raw command-line options, exposing the CLI parser surface to untrusted files. This enables attackers to craft malicious RDP files leveraging options such as /rd...