SUSE CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

SUSE CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

SUSE CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

SUSE CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67299

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...

CVE-2026-67293

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol RDP. The software's Transport Layer Security TLS hostname matcher incorrectly validates wildcard certificates, allowing it to accept certificates for multi-label subdomains that should not be covered. This...

CVE-2026-67302

A flaw was found in FreeRDP, a remote desktop protocol client. A malicious or compromised RDP server can exploit this vulnerability by sending a specially crafted StartStreamsRequest with a zero value for FrameRateDenominator. If camera redirection is enabled on the client, this action triggers a...

The vulnerability of the RDP client FreeRDP, related to buffer overflow in dynamic memory, allows a hacker to trigger a service failure.

The vulnerability of the RDP client FreeRDP is related to overflow in the buffer in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2026-68579

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

CVE-2026-68580 FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel audin across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing...

Linux Distros Unpatched Vulnerability : CVE-2026-67293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname i...

Linux Distros Unpatched Vulnerability : CVE-2026-67296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before strea...

Linux Distros Unpatched Vulnerability : CVE-2026-67297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

UBUNTU-CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...

CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

UBUNTU-CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...

UBUNTU-CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...