Freerdp vulnerabilities
323 CVEs and advisories name Freerdp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-91956FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
- CVE-2026-91955FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions
- CVE-2026-91954FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec
- CVE-2026-91953FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
- CVE-2026-91952FreeRDP before 3.31.0 Denial of Service via pool_decode_rect
- CVE-2026-91951FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
- CVE-2026-91950FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
- CVE-2026-91949FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
- CVE-2026-91948FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
- CVE-2026-91947FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC
- CVE-2026-91946FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
- CVE-2026-91945FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR
- CVE-2026-85090FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
- CVE-2026-85089FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
- CVE-2026-63633FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
- CVE-2026-63652FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU
- CVE-2026-63117FreeRDP: Denial of service through ADPCM frame size calculation
- CVE-2026-55192FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
- CVE-2026-55194FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
- CVE-2026-55648FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check
- CVE-2026-55193FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag
- CVE-2026-55564FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
- CVE-2026-55191FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
- CVE-2026-73242FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
- CVE-2026-73241FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)
- CVE-2026-68580FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
- CVE-2026-68579FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
- CVE-2026-67298FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
- CVE-2026-67291FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
- CVE-2026-67300FreeRDP before 3.29.0 Use-After-Free via async message proxy