# cve.now: Freerdp

The newest entries naming Freerdp as an affected vendor (up to 200), of 323 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125394](https://cve.now/CVE-2026-125394.md): FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer (CVSS 5.3)
- [CVE-2026-121964](https://cve.now/CVE-2026-121964.md): FreeRDP before 3.32.2 Heap Buffer Overflow via rpc\_client\_recv\_fragment (CVSS 8.7)
- [CVE-2026-121963](https://cve.now/CVE-2026-121963.md): FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close (CVSS 8.2)
- [CVE-2026-121962](https://cve.now/CVE-2026-121962.md): FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read (CVSS 7.2)
- [CVE-2026-121961](https://cve.now/CVE-2026-121961.md): FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race (CVSS 8.2)
- [CVE-2026-121960](https://cve.now/CVE-2026-121960.md): FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest (CVSS 8.7)
- [CVE-2026-121959](https://cve.now/CVE-2026-121959.md): FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame (CVSS 7.1)
- [CVE-2026-121958](https://cve.now/CVE-2026-121958.md): FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable\_GetKeys (CVSS 8.7)
- [CVE-2026-121957](https://cve.now/CVE-2026-121957.md): FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race (CVSS 8.7)
- [CVE-2026-121956](https://cve.now/CVE-2026-121956.md): FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt (CVSS 8.7)
- [CVE-2026-121955](https://cve.now/CVE-2026-121955.md): FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext (CVSS 8.7)
- [CVE-2026-121954](https://cve.now/CVE-2026-121954.md): FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec (CVSS 7.1)
- [CVE-2026-121953](https://cve.now/CVE-2026-121953.md): FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close (CVSS 9.3)
- [CVE-2026-121952](https://cve.now/CVE-2026-121952.md): FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability (CVSS 9.3)
- [CVE-2026-121951](https://cve.now/CVE-2026-121951.md): FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event (CVSS 8.7)
- [CVE-2026-121950](https://cve.now/CVE-2026-121950.md): FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE\_SURFACE Integer Wrap (CVSS 7.1)
- [CVE-2026-121412](https://cve.now/CVE-2026-121412.md): FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly (CVSS 7.1)
- [CVE-2026-121411](https://cve.now/CVE-2026-121411.md): FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry (CVSS 2.3)
- [CVE-2026-121410](https://cve.now/CVE-2026-121410.md): FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE\_2 (CVSS 5.3)
- [CVE-2026-121409](https://cve.now/CVE-2026-121409.md): FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token (CVSS 8.2)
- [CVE-2026-121408](https://cve.now/CVE-2026-121408.md): FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel (CVSS 6.0)
- [CVE-2026-121407](https://cve.now/CVE-2026-121407.md): FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel (CVSS 7.1)
- [CVE-2026-121406](https://cve.now/CVE-2026-121406.md): FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload (CVSS 5.3)
- [CVE-2026-121405](https://cve.now/CVE-2026-121405.md): FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control (CVSS 5.3)
- [CVE-2026-121404](https://cve.now/CVE-2026-121404.md): FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA (CVSS 7.1)
- [CVE-2026-121403](https://cve.now/CVE-2026-121403.md): FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP (CVSS 5.3)
- [CVE-2026-121402](https://cve.now/CVE-2026-121402.md): FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics (CVSS 7.1)
- [CVE-2026-121401](https://cve.now/CVE-2026-121401.md): FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet (CVSS 5.3)
- [CVE-2026-121400](https://cve.now/CVE-2026-121400.md): FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet (CVSS 7.1)
- [CVE-2026-121399](https://cve.now/CVE-2026-121399.md): FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length (CVSS 5.3)
- [CVE-2026-121398](https://cve.now/CVE-2026-121398.md): FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module (CVSS 8.2)
- [CVE-2026-121397](https://cve.now/CVE-2026-121397.md): FreeRDP before 3.32.2 Heap Over-Read via WinPR save\_png\_to\_buffer() (CVSS 5.3)
- [CVE-2026-121396](https://cve.now/CVE-2026-121396.md): FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion (CVSS 5.3)
- [CVE-2026-121395](https://cve.now/CVE-2026-121395.md): FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder (CVSS 7.1)
- [CVE-2026-121394](https://cve.now/CVE-2026-121394.md): FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder (CVSS 7.1)
- [CVE-2026-121393](https://cve.now/CVE-2026-121393.md): FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion (CVSS 7.1)
- [CVE-2026-121392](https://cve.now/CVE-2026-121392.md): FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls\_verify\_certificate (CVSS 9.1)
- [CVE-2026-121391](https://cve.now/CVE-2026-121391.md): FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE (CVSS 5.3)
- [CVE-2026-121390](https://cve.now/CVE-2026-121390.md): FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response (CVSS 5.3)
- [CVE-2026-121389](https://cve.now/CVE-2026-121389.md): FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging (CVSS 2.3)
- [CVE-2026-121388](https://cve.now/CVE-2026-121388.md): FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA\_FIRST (CVSS 7.1)
- [CVE-2026-121387](https://cve.now/CVE-2026-121387.md): FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder (CVSS 5.3)
- [CVE-2026-121386](https://cve.now/CVE-2026-121386.md): FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers (CVSS 8.7)
- [CVE-2026-114047](https://cve.now/CVE-2026-114047.md): FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation (CVSS 7.6)
- [CVE-2026-114046](https://cve.now/CVE-2026-114046.md): FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard (CVSS 7.1)
- [CVE-2026-114045](https://cve.now/CVE-2026-114045.md): FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd\_server\_select\_format (CVSS 8.7)
- [CVE-2026-114044](https://cve.now/CVE-2026-114044.md): FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline (CVSS 6.9)
- [CVE-2026-114043](https://cve.now/CVE-2026-114043.md): Vulnerability in FreeRDP (CVSS 7.1)
- [CVE-2026-114042](https://cve.now/CVE-2026-114042.md): FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU (CVSS 7.1)
- [CVE-2026-114041](https://cve.now/CVE-2026-114041.md): FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message (CVSS 6.9)
- [CVE-2026-111881](https://cve.now/CVE-2026-111881.md): FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard (CVSS 7.2)
- [CVE-2026-111880](https://cve.now/CVE-2026-111880.md): FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset (CVSS 8.3)
- [CVE-2026-111382](https://cve.now/CVE-2026-111382.md): FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine (CVSS 8.7)
- [CVE-2026-111381](https://cve.now/CVE-2026-111381.md): FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser (CVSS 7.0)
- [CVE-2026-111380](https://cve.now/CVE-2026-111380.md): FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends (CVSS 8.7)
- [CVE-2026-111379](https://cve.now/CVE-2026-111379.md): FreeRDP before 3.32.0 Heap Buffer Overflow via persistent\_cache\_read\_entry\_v3 (CVSS 7.0)
- [CVE-2026-111378](https://cve.now/CVE-2026-111378.md): FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser (CVSS 8.7)
- [CVE-2026-111377](https://cve.now/CVE-2026-111377.md): FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly (CVSS 7.1)
- [CVE-2026-111376](https://cve.now/CVE-2026-111376.md): FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS\_SIZE (CVSS 2.3)
- [CVE-2026-111375](https://cve.now/CVE-2026-111375.md): FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title (CVSS 6.3)
- [CVE-2026-111374](https://cve.now/CVE-2026-111374.md): FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest (CVSS 6.0)
- [CVE-2026-111373](https://cve.now/CVE-2026-111373.md): FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping (CVSS 6.9)
- [CVE-2026-110839](https://cve.now/CVE-2026-110839.md): FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data (CVSS 7.1)
- [CVE-2026-110838](https://cve.now/CVE-2026-110838.md): FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass (CVSS 8.7)
- [CVE-2026-110837](https://cve.now/CVE-2026-110837.md): FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding (CVSS 6.1)
- [CVE-2026-110836](https://cve.now/CVE-2026-110836.md): FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type (CVSS 7.1)
- [CVE-2026-110835](https://cve.now/CVE-2026-110835.md): FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token (CVSS 6.3)
- [CVE-2026-110834](https://cve.now/CVE-2026-110834.md): FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle (CVSS 7.1)
- [CVE-2026-110833](https://cve.now/CVE-2026-110833.md): FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy (CVSS 8.2)
- [CVE-2026-110832](https://cve.now/CVE-2026-110832.md): FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA\_FIRST (CVSS 7.1)
- [CVE-2026-110831](https://cve.now/CVE-2026-110831.md): FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP\_MJ\_CREATE (CVSS 5.3)
- [CVE-2026-110830](https://cve.now/CVE-2026-110830.md): FreeRDP before 3.32.0 Denial of Service via Serial IRP\_MJ\_CREATE (CVSS 8.2)
- [CVE-2026-110829](https://cve.now/CVE-2026-110829.md): FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment (CVSS 7.1)
- [CVE-2026-109953](https://cve.now/CVE-2026-109953.md): FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin (CVSS 6.0)
- [CVE-2026-109952](https://cve.now/CVE-2026-109952.md): FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response (CVSS 6.0)
- [CVE-2026-109951](https://cve.now/CVE-2026-109951.md): FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name (CVSS 6.9)
- [CVE-2026-109950](https://cve.now/CVE-2026-109950.md): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages (CVSS 5.3)
- [CVE-2026-109949](https://cve.now/CVE-2026-109949.md): FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard (CVSS 7.1)
- [CVE-2026-109948](https://cve.now/CVE-2026-109948.md): FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection (CVSS 5.3)
- [CVE-2026-109947](https://cve.now/CVE-2026-109947.md): FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive\_process\_irp\_read (CVSS 7.1)
- [CVE-2026-109946](https://cve.now/CVE-2026-109946.md): FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width (CVSS 7.1)
- [CVE-2026-109945](https://cve.now/CVE-2026-109945.md): FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit (CVSS 6.0)
- [CVE-2026-109944](https://cve.now/CVE-2026-109944.md): FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle (CVSS 7.1)
- [CVE-2026-109943](https://cve.now/CVE-2026-109943.md): FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order (CVSS 7.1)
- [CVE-2026-109942](https://cve.now/CVE-2026-109942.md): FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet (CVSS 7.1)
- [CVE-2026-109941](https://cve.now/CVE-2026-109941.md): FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response (CVSS 7.1)
- [CVE-2026-109940](https://cve.now/CVE-2026-109940.md): FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name (CVSS 5.1)
- [CVE-2026-109939](https://cve.now/CVE-2026-109939.md): FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order (CVSS 7.1)
- [CVE-2026-109938](https://cve.now/CVE-2026-109938.md): FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update (CVSS 7.1)
- [CVE-2026-109680](https://cve.now/CVE-2026-109680.md): FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username (CVSS 6.0)
- [CVE-2026-109679](https://cve.now/CVE-2026-109679.md): FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response (CVSS 6.0)
- [CVE-2026-109678](https://cve.now/CVE-2026-109678.md): FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA (CVSS 7.1)
- [CVE-2026-109677](https://cve.now/CVE-2026-109677.md): FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler (CVSS 7.1)
- [CVE-2026-109676](https://cve.now/CVE-2026-109676.md): FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVSS 8.7)
- [CVE-2026-109257](https://cve.now/CVE-2026-109257.md): FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure (CVSS 8.2)
- [CVE-2026-109256](https://cve.now/CVE-2026-109256.md): FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion (CVSS 6.0)
- [CVE-2026-109255](https://cve.now/CVE-2026-109255.md): FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license\_check\_stream\_length (CVSS 6.1)
- [CVE-2026-109254](https://cve.now/CVE-2026-109254.md): FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path (CVSS 6.0)
- [CVE-2026-109253](https://cve.now/CVE-2026-109253.md): FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read (CVSS 6.0)
- [CVE-2026-109252](https://cve.now/CVE-2026-109252.md): FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB\_RPC\_INTERNAL\_NAME (CVSS 6.0)
- [CVE-2026-109251](https://cve.now/CVE-2026-109251.md): FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry (CVSS 6.0)
- [CVE-2026-109250](https://cve.now/CVE-2026-109250.md): FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect\_keys() (CVSS 7.0)
- [CVE-2026-109249](https://cve.now/CVE-2026-109249.md): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing (CVSS 6.8)
- [CVE-2026-109248](https://cve.now/CVE-2026-109248.md): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName (CVSS 6.9)
- [CVE-2026-109247](https://cve.now/CVE-2026-109247.md): FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName (CVSS 2.1)
- [CVE-2026-109246](https://cve.now/CVE-2026-109246.md): FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU (CVSS 7.1)
- [CVE-2026-109245](https://cve.now/CVE-2026-109245.md): FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp\_http\_request (CVSS 7.4)
- [CVE-2026-109244](https://cve.now/CVE-2026-109244.md): FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert (CVSS 6.8)
- [CVE-2026-109243](https://cve.now/CVE-2026-109243.md): FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File (CVSS 4.1)
- [CVE-2026-109242](https://cve.now/CVE-2026-109242.md): FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade (CVSS 7.1)
- [CVE-2026-109241](https://cve.now/CVE-2026-109241.md): FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel (CVSS 2.3)
- [CVE-2026-109240](https://cve.now/CVE-2026-109240.md): FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb\_isoch\_transfer (CVSS 2.3)
- [CVE-2026-91964](https://cve.now/CVE-2026-91964.md): FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken (CVSS 8.7)
- [CVE-2026-91963](https://cve.now/CVE-2026-91963.md): FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc (CVSS 7.1)
- [CVE-2026-91962](https://cve.now/CVE-2026-91962.md): FreeRDP before 3.31.0 Integer Overflow via audin Apple backends (CVSS 5.3)
- [CVE-2026-91961](https://cve.now/CVE-2026-91961.md): FreeRDP before 3.31.0 Denial of Service via URBDRC (CVSS 7.1)
- [CVE-2026-91960](https://cve.now/CVE-2026-91960.md): FreeRDP before 3.31.0 Integer Overflow Double Free (CVSS 6.5)
- [CVE-2026-91959](https://cve.now/CVE-2026-91959.md): FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway (CVSS 6.5)
- [CVE-2026-91958](https://cve.now/CVE-2026-91958.md): FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index (CVSS 6.9)
- [CVE-2026-91957](https://cve.now/CVE-2026-91957.md): FreeRDP before 3.31.0 Use-After-Free via smartcard worker (CVSS 2.3)
- [CVE-2026-91956](https://cve.now/CVE-2026-91956.md): FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC (CVSS 7.1)
- [CVE-2026-91955](https://cve.now/CVE-2026-91955.md): FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions (CVSS 8.2)
- [CVE-2026-91954](https://cve.now/CVE-2026-91954.md): FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec (CVSS 7.1)
- [CVE-2026-91953](https://cve.now/CVE-2026-91953.md): FreeRDP before 3.31.0 Heap Buffer Overflow via LB\_LOAD\_BALANCE\_INFO (CVSS 7.1)
- [CVE-2026-91952](https://cve.now/CVE-2026-91952.md): FreeRDP before 3.31.0 Denial of Service via pool\_decode\_rect (CVSS 7.1)
- [CVE-2026-91951](https://cve.now/CVE-2026-91951.md): FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc (CVSS 7.1)
- [CVE-2026-91950](https://cve.now/CVE-2026-91950.md): FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound (CVSS 7.1)
- [CVE-2026-91949](https://cve.now/CVE-2026-91949.md): FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVSS 9.2)
- [CVE-2026-91948](https://cve.now/CVE-2026-91948.md): FreeRDP before 3.31.0 Out-of-bounds Write via SHOW\_PROTOCOL (CVSS 7.7)
- [CVE-2026-91947](https://cve.now/CVE-2026-91947.md): FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC (CVSS 7.7)
- [CVE-2026-91946](https://cve.now/CVE-2026-91946.md): FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics (CVSS 7.1)
- [CVE-2026-91945](https://cve.now/CVE-2026-91945.md): FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR (CVSS 7.1)
- [CVE-2026-85090](https://cve.now/CVE-2026-85090.md): FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 (CVSS 5.3)
- [CVE-2026-85089](https://cve.now/CVE-2026-85089.md): FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory (CVSS 7.1)
- [CVE-2026-63633](https://cve.now/CVE-2026-63633.md): FreeRDP: Heap buffer overflow in Opus audio decode (\`freerdp\_dsp\_decode\_opus\` resizes the wrong stream) — server→client (CVSS 7.7)
- [CVE-2026-63652](https://cve.now/CVE-2026-63652.md): FreeRDP: Double-free of \`client\_formats\` in the rdpsnd server channel on a malformed Client Audio Formats PDU (CVSS 7.1)
- [CVE-2026-63117](https://cve.now/CVE-2026-63117.md): FreeRDP: Denial of service through ADPCM frame size calculation (CVSS 6.5)
- [CVE-2026-55192](https://cve.now/CVE-2026-55192.md): FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch (CVSS 7.2)
- [CVE-2026-55194](https://cve.now/CVE-2026-55194.md): FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc\_hint capacity mismatch (CVSS 8.7)
- [CVE-2026-55648](https://cve.now/CVE-2026-55648.md): FreeRDP: Integer Overflow in \`freerdp\_image\_copy\_from\_icon\_data\` Bypasses Bounds Check (CVSS 6.1)
- [CVE-2026-55193](https://cve.now/CVE-2026-55193.md): FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind\_ack max\_xmit\_frag (CVSS 8.7)
- [CVE-2026-55564](https://cve.now/CVE-2026-55564.md): FreeRDP: Out-of-bounds read in glyph\_cache\_get via crafted glyph fragments (CVSS 5.4)
- [CVE-2026-55191](https://cve.now/CVE-2026-55191.md): FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation (CVSS 8.7)
- [CVE-2026-73242](https://cve.now/CVE-2026-73242.md): FreeRDP: Kerberos GSS Wrap-token \`EC\` field is unbounded, causing an out-of-bounds decrypt in \`kerberos\_DecryptMessage\` (CVSS 8.3)
- [CVE-2026-73241](https://cve.now/CVE-2026-73241.md): FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open \`resultCode\`) (CVSS 8.3)
- [CVE-2026-68580](https://cve.now/CVE-2026-68580.md): FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel (CVSS 7.7)
- [CVE-2026-68579](https://cve.now/CVE-2026-68579.md): FreeRDP before 3.30.0 Heap Overflow via CliprdrStream\_Read (CVSS 8.7)
- [CVE-2026-67298](https://cve.now/CVE-2026-67298.md): FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow (CVSS 8.7)
- [CVE-2026-67291](https://cve.now/CVE-2026-67291.md): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH\_FRAGMENT\_ADD (CVSS 8.7)
- [CVE-2026-67300](https://cve.now/CVE-2026-67300.md): FreeRDP before 3.29.0 Use-After-Free via async message proxy (CVSS 8.7)
- [CVE-2026-67299](https://cve.now/CVE-2026-67299.md): FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message (CVSS 8.7)
- [CVE-2026-67288](https://cve.now/CVE-2026-67288.md): FreeRDP before 3.29.0 Denial of Service via smartcard cache (CVSS 8.7)
- [CVE-2026-67303](https://cve.now/CVE-2026-67303.md): FreeRDP before 3.29.0 Denial of Service via serial DeviceControl (CVSS 5.3)
- [CVE-2026-67295](https://cve.now/CVE-2026-67295.md): FreeRDP before 3.29.0 Path Traversal via drive redirection (CVSS 5.3)
- [CVE-2026-67292](https://cve.now/CVE-2026-67292.md): FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure (CVSS 9.3)
- [CVE-2026-66401](https://cve.now/CVE-2026-66401.md): FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 (CVSS 2.4)
- [CVE-2026-67302](https://cve.now/CVE-2026-67302.md): FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service (CVSS 5.3)
- [CVE-2026-67306](https://cve.now/CVE-2026-67306.md): FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE (CVSS 5.3)
- [CVE-2026-67289](https://cve.now/CVE-2026-67289.md): FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection (CVSS 9.3)
- [CVE-2026-67294](https://cve.now/CVE-2026-67294.md): FreeRDP before 3.29.0 TLS Certificate EKU Bypass (CVSS 9.3)
- [CVE-2026-67296](https://cve.now/CVE-2026-67296.md): FreeRDP before 3.29.0 Denial of Service via RDPEI PDU (CVSS 8.7)
- [CVE-2026-67304](https://cve.now/CVE-2026-67304.md): FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup (CVSS 8.7)
- [CVE-2026-66402](https://cve.now/CVE-2026-66402.md): FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass (CVSS 9.3)
- [CVE-2026-67297](https://cve.now/CVE-2026-67297.md): FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response (CVSS 8.7)
- [CVE-2026-67301](https://cve.now/CVE-2026-67301.md): FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy (CVSS 8.7)
- [CVE-2026-67293](https://cve.now/CVE-2026-67293.md): FreeRDP before 3.29.0 Improper Certificate Hostname Validation (CVSS 9.3)
- [CVE-2026-67305](https://cve.now/CVE-2026-67305.md): FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr (CVSS 9.4)
- [CVE-2026-67290](https://cve.now/CVE-2026-67290.md): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF (CVSS 8.7)
- [CVE-2026-64624](https://cve.now/CVE-2026-64624.md): FreeRDP RDP File Parser Remote Code Execution via CLI Options (CVSS 8.5)
- [CVE-2026-64621](https://cve.now/CVE-2026-64621.md): FreeRDP before 3.28.0 Double-Free via selectedmonitors (CVSS 9.3)
- [CVE-2026-64620](https://cve.now/CVE-2026-64620.md): FreeRDP before 3.28.0 Heap Buffer Overflow via crypto\_rsa\_common (CVSS 9.3)
- [CVE-2026-57156](https://cve.now/CVE-2026-57156.md): FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing (CVSS 8.6)
- [CVE-2026-57157](https://cve.now/CVE-2026-57157.md): Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName (CVSS 6.5)
- [CVE-2026-57158](https://cve.now/CVE-2026-57158.md): FreeRDP planar\_decompress\_plane\_rle\_only: heap OOB read — incomplete fix for CVE-2026-23530 (CVSS 5.1)
- [CVE-2026-55827](https://cve.now/CVE-2026-55827.md): FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode (CVSS 7.5)
- [CVE-2026-56297](https://cve.now/CVE-2026-56297.md): FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback (CVSS 8.3)
- [CVE-2026-45700](https://cve.now/CVE-2026-45700.md): Heap-buffer-overflow write in planar bitmap decoder (CVSS 7.7)
- [CVE-2026-44420](https://cve.now/CVE-2026-44420.md): FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB\_CLIP\_CAPS (CVSS 8.8)
- [CVE-2026-44422](https://cve.now/CVE-2026-44422.md): FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion (CVSS 7.5)
- [CVE-2026-44421](https://cve.now/CVE-2026-44421.md): FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass (CVSS 8.8)
- [CVE-2026-40033](https://cve.now/CVE-2026-40033.md): FreeRDP - Heap-buffer-overflow in gdi\_CacheToSurface via rectangle validation bypass (CVSS 8.6)
- [CVE-2026-40254](https://cve.now/CVE-2026-40254.md): FreeRDP: contains\_dotdot() off-by-one allows drive channel path traversal via terminal .. (CVSS 4.2)
- [CVE-2026-33995](https://cve.now/CVE-2026-33995.md): FreeRDP: Possible double free in kerberos\_AcceptSecurityContext (CVSS 5.3)
- [CVE-2026-33987](https://cve.now/CVE-2026-33987.md): FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write (CVSS 7.1)
- [CVE-2026-33986](https://cve.now/CVE-2026-33986.md): FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write (CVSS 7.5)
- [CVE-2026-33985](https://cve.now/CVE-2026-33985.md): FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read (CVSS 5.9)
- [CVE-2026-33984](https://cve.now/CVE-2026-33984.md): FreeRDP: ClearCodec resize\_vbar\_entry() Heap OOB Write (CVSS 7.5)
- [CVE-2026-33983](https://cve.now/CVE-2026-33983.md): FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS (CVSS 6.5)
- [CVE-2026-33982](https://cve.now/CVE-2026-33982.md): FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read (CVSS 7.1)
- [CVE-2026-33952](https://cve.now/CVE-2026-33952.md): FreeRDP: DoS via WINPR\_ASSERT in rts\_read\_auth\_verifier\_no\_checks (CVSS 6.0)
- [CVE-2026-33977](https://cve.now/CVE-2026-33977.md): FreeRDP: DoS via WINPR\_ASSERT in IMA ADPCM audio decoder (dsp.c:331) (CVSS 6.9)
- [CVE-2026-31897](https://cve.now/CVE-2026-31897.md): FreeRDP has an out-of-bounds read in \`freerdp\_bitmap\_decompress\_planar\` (CVSS 0.0)
- [CVE-2026-31806](https://cve.now/CVE-2026-31806.md): FreeRDP has a Heap Buffer Overflow in nsc\_process\_message() via Unchecked SURFACE\_BITS\_COMMAND Bitmap Dimensions (CVSS 9.3)
- [CVE-2026-31885](https://cve.now/CVE-2026-31885.md): FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step\_index bounds checks (CVSS 6.5)
- [CVE-2026-31884](https://cve.now/CVE-2026-31884.md): FreeRDP has a division-by-zero in ADPCM decoders when \`nBlockAlign\` is 0 (CVSS 6.5)
- [CVE-2026-31883](https://cve.now/CVE-2026-31883.md): FreeRDP has a \`size\_t\` underflow in ADPCM decoder leads to heap-buffer-overflow write (CVSS 6.5)
- [CVE-2026-29776](https://cve.now/CVE-2026-29776.md): FreeRDP has an Integer Underflow in update\_read\_cache\_bitmap\_order Function of FreeRDP's Core Library (CVSS 3.1)
- [CVE-2026-29775](https://cve.now/CVE-2026-29775.md): FreeRDP has a heap-buffer-overflow in bitmap\_cache\_put via OOB cacheId (CVSS 5.3)
- [CVE-2026-29774](https://cve.now/CVE-2026-29774.md): FreeRDP has a heap-buffer-overflow in avc420\_yuv\_to\_rgb via OOB regionRects (CVSS 5.3)
- [CVE-2026-27951](https://cve.now/CVE-2026-27951.md): FreeRDP has possible Integer overflow in Stream\_EnsureCapacity (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/freerdp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.