RLSA-2026:76755 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command...

FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RockyLinux 8 : freerdp (RLSA-2026:76747)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76747 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command...

FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2023_2851)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20232851 advisory. freerdp: clients using /parallel command line switch might read uninitialized data CVE-2022-39282 freerdp: clients using the /video command line switch mig...

SUSE CVE-2026-91956

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...

CVE-2026-91951

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send a specially crafted USB redirection message to the urbdrc client channel. This can trigger an out-of-bounds write, leading to a denial of service DoS for the client when verbose asserts are enabled. Mitigation To...

DEBIAN-CVE-2026-91956

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...

DEBIAN-CVE-2026-91951

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

EUVD-2026-78639

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

EUVD-2026-78632

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...

CVE-2026-91956

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel's func_get_ep_desc function. The root cause is an index mismatch : the function indexes interface arrays by position rather than by the protocol field InterfaceNumber. A malicious RDP...

CVE-2026-91956 FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...

EUVD-2026-78808

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

CVE-2026-91951 FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

CVE-2026-91956: Out-of-bounds Read

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...