CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

CVE-2026-63633

FreeRDP prior to 3.28.0 contains a heap buffer overflow in freerdp_dsp_decode_opus (libfreerdp/codec/dsp.c). The function calls Stream_EnsureRemainingCapacity on context->common.buffer, but opus_decode actually writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

EUVD-2026-62671

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

gnome-remote-desktop security update

An update is available for gnome-remote-desktop. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNOME Remote Desktop is a remote desktop and screen sharing...

RLSA-2026:54512 Moderate: gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 For more details about the...

Moderate: Red Hat Security Advisory: gnome-remote-desktop security update

An update for gnome-remote-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 10 : gnome-remote-desktop (RHSA-2026:54512)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54512 advisory. GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop:...

CVE-2026-68579

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

UBUNTU-CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

EUVD-2026-46017

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices ar...

[SECURITY] Fedora 44 Update: xrdp-0.10.6.1-1.fc44

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client...

DEBIAN-CVE-2026-40033

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdiCacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16MAX but performs copy operations using unclamped cache entry...

[SECURITY] Fedora 43 Update: xrdp-0.10.6-1.fc43

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client...

freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol RDP. The gdisurfacebits function, which processes SURFACEBITSCOMMAND messages, does not properly validate image dimensions bmp.width and bmp.height provided by a malicious RDP server. This can lead to a heap buffer...

Unity Linux 20.1070e Security Update: freerdp (UTSA-2026-006940)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006940 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful for...

UBUNTU-CVE-2026-33516

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerabilit...