CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

DEBIAN-CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

DEBIAN-CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

RHSA-2026:62571 Red Hat Security Advisory: freerdp security update

Bulletin has no description...

CVE-2026-85090

A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A remote attacker, acting as a malicious Remote Desktop Protocol RDP server, can exploit this by sending a specially crafted...

CVE-2026-85089

A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units PDUs u...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

EUVD-2026-70299

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85090 FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 are affected by an information disclosure vulnerability in the Save Session Info PDU writers within libfreerdp/core/info.c. Three functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Ze...

EUVD-2026-70300

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85090

FreeRDP before 3.31.0 is affected by a heap out-of-bounds read in the general_ChromaV1ToYUV444 function, which handles AVC444 chroma plane reconstruction . A malicious RDP server can craft an RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the al...

CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85090 FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

AlmaLinux 8 : freerdp (ALSA-2026:62571)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62571 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

RockyLinux 8 : freerdp (RLSA-2026:62571)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62571 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

Oracle Linux 8 : ELSA-2026-62571-0: / freerdp (ELSA-2026-625710)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-625710 advisory. 2:2.11.7-12 - Backport several CVE fixes CVE-2026-55194, CVE-2026-67288, CVE-2026-67291, CVE-2026-67301 Resolves: RHEL-225093, RHEL-227724,...