SUSE CVE-2026-121389

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

CVE-2026-121389

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by sending a malformed Device Redirection RDPDR announcement. Under configurations where diagnostic trace logging and assertions are active, processing the invalid data length triggers ...

CVE-2026-121389

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

CVE-2026-121405 FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a...

CVE-2026-121405

FreeRDP versions before 3.32.2 are vulnerable to a memory exhaustion issue within the serial RDPDR device control. The root cause is a failure to cap the OutputBufferLength in serial device-control IRP requests. A malicious server using serial redirection can trigger excessive memory allocation o...

CVE-2026-121405 FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a...

CVE-2026-121389 FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

CVE-2026-121389 FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

EUVD-2026-115921

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

CVE-2026-121389

FreeRDP versions 3.27.0 before 3.32.2 are vulnerable to a denial of service (DoS) flaw in the rdpdr_dump_packet function. A malicious RDP server can cause a client to abort by sending malformed RDPDR device-list announcements where the DeviceDataLength exceeds the received packet size. This trigg...

freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection RDPDR channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous da...

Linux Distros Unpatched Vulnerability : CVE-2026-121389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending...

CVE-2026-121389: FreeRDP: FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious…

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 contain an off-by-one error in the path traversal filter within channels/drive/client/drivefile.c. The containsdotdot function handles ../ and ..\ as valid paths, but fails to recognize .. when it appears as...

SUSE CVE-2026-110833

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

Astra Linux – vulnerability in freerdp3

FreeRDP versions prior to 3.31.0 contain a use-after-free vulnerability in the smartcard RDPDR device handler. This occurs when worker thread creation fails following device registration. Attackers can exploit this by causing thread creation to fail during channel setup, resulting in device point...

CVE-2026-110833

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection RDPDR channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous da...

EUVD-2026-101716

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

Linux Distros Unpatched Vulnerability : CVE-2026-110833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can...