PT-2026-3458

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description A heap buffer overflow exists in the RDPGFX ClearCodec decode path when processing maliciously crafted residual data, leading to out-of-bounds writes during color output. This can cause a...

PT-2026-7125

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw. A NULL pointer dereference exists in the rdp write logon info v2 function. A malicious RDP server can exploit this by...

PT-2026-2932

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A heap-buffer-overflow can occur in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound. This allows an oversized re...

PT-2026-3466

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw where the xf Pointer New function incorrectly frees memory associated with cursorPixels both on failure and during norm...

PT-2026-7039

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw related to memory management. Specifically, versions before 3.22.0 improperly handle memory deallocation within the sdl...

PT-2026-25332

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal...

PT-2026-25338

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.24.0 contain an out-of-bounds read in the MS-ADPCM and IMA-ADPCM decoders. This issue is caused by unchecked...

PT-2026-7041

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the audin server recv formats function incorrectly calculates the number of audio formats to free upon parse failure...

PT-2026-7034

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw in the urb select interface function. Specifically, the function can free a device’s MS configuration on error, but subsequent code...

PT-2026-25337

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A division by zero error exists in the MS-ADPCM and IMA-ADPCM decoders when the nBlockAlign variable is 0, resulting in a crash. The...

PT-2026-7040

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to asynchronous bulk transfer completions. Specifically, the software can utilize a freed channel callback following a URBD...

PT-2026-7042

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw related to the ainput send input event function. This function caches a channel callback in a local variable and subsequently uses ...

PT-2026-22009

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions before 3.23.0 contain a flaw where the xf SetWindowMinMaxInfo function improperly dereferences a freed xfAppWindow pointer...

PT-2026-22014

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A heap use after free condition exists in the clipboard handling functionality. Specifically, the xf clipboard format equal function...

PT-2026-2930

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A malicious RDP server can cause a heap-buffer-overflow write in the FreeRDP client when processing Audio Input AUDIN format lists. The audin process formats function reuses the callback-formats cou...

PT-2026-7038

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the URBDRC client utilizes interface numbers provided by the server as array indices without proper bounds checking. This can...

PT-2026-29133

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. An unvalidated auth length field read from the network triggers a WINPR ASSERT failure in the rts read auth verifier no checks...

PT-2026-29135

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.24.2 contain a heap-buffer-overflow READ vulnerability. This issue occurs due to a 24-byte buffer overflow before...

PT-2026-7033

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0 Description FreeRDP, a Remote Desktop Protocol implementation, contains a flaw where the video timer component may send client notifications after the control channel has been closed. This action can lead to a...

PT-2026-25336

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A size t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to a heap-buffer-overflow write via the RDPSND audio channel. T...