CVE-2026-67296

CVE-2026-67296 affects FreeRDP prior to 3.29.0, where the RDPEI server channel handler may allocate excessive memory if a header-only RDPEI message declares a large body length, enabling a denial-of-service. This is documented in the NVD/CVE entries and CVE listing; no patch details are provided ...

EUVD-2026-51857

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

CVE-2026-67293 FreeRDP before 3.29.0 Improper Certificate Hostname Validation

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-67297

FreeRDP prior to 3.29.0 contains a flaw in http_response_recv_body() where RESPONSE_SIZE_LIMIT is not enforced for Transfer-Encoding: chunked HTTP responses. This allows an attacker controlling a malicious RD Gateway endpoint to send oversized chunked bodies, exhausting memory on the client. Impa...

CVE-2026-67298: Integer Underflow (Wrap or Wraparound)

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

PT-2026-67280

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A client-side heap use-after-free issue exists in the async update message proxy for RAIL WINDOW STATE ORDER and NOTIFY ICON STATE ORDER when AsyncUpdate is enabled. A malicious or compromised RDP...

SUSE CVE-2026-64621

FreeRDP before 3.28.0 affected 3.x through 3.27.1 contains a double-free vulnerability in freerdpclientrdpfileapplytosettings client/common/file.c when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-18358: Uncontrolled Resource Consumption

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

File-Tunnel v3.5.0

File Tunnel Tunnel TCP connections through a file server. A full list of supported file systems can be found here. Download Portable executables for Windows, Linux and Mac can be found over in the releases section. Example 1 - Bypassing a firewall You'd like to connect from Host A to Host B, but ...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Linux Distros Unpatched Vulnerability : CVE-2026-64624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted...

NETworkManager v2026.7.24.0

NETworkManager A powerful open-source tool for managing networks and troubleshooting network problems! Streamline and simplify your network administration and troubleshooting with NETworkManager. Connect, monitor, and troubleshoot your network and server infrastructure using built-in tools like...

SUSE CVE-2026-54538

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-64620

A heap-based buffer overflow in FreeRDP's cryptorsacommon allows an unauthenticated remote attacker to trigger a denial of service or potential remote code execution. By sending a crafted ciphertext during RDP Standard Security key establishment, the attacker can force a data write before the siz...

EUVD-2026-46118

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

UBUNTU-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...