Freerdp vulnerabilities
323 CVEs and advisories name Freerdp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-40033FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass
- CVE-2026-40254FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..
- CVE-2026-33995FreeRDP: Possible double free in kerberos_AcceptSecurityContext
- CVE-2026-33987FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write
- CVE-2026-33986FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write
- CVE-2026-33985FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read
- CVE-2026-33984FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write
- CVE-2026-33983FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS
- CVE-2026-33982FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read
- CVE-2026-33952FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks
- CVE-2026-33977FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)
- CVE-2026-31897FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`
- CVE-2026-31806FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions
- CVE-2026-31885FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
- CVE-2026-31884FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
- CVE-2026-31883FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write
- CVE-2026-29776FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library
- CVE-2026-29775FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
- CVE-2026-29774FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects
- CVE-2026-27951FreeRDP has possible Integer overflow in Stream_EnsureCapacity
- CVE-2026-27950FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File
- CVE-2026-26986FreeRDP has heap-use-after-free in rail_window_free
- CVE-2026-26965FreeRDP has Out-of-bounds Write
- CVE-2026-26955FreeRDP has Out-of-bounds Write
- CVE-2026-27015FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)
- CVE-2026-26271Buffer Overread in FreeRDP Icon Processing
- CVE-2026-25997FreeRDP has heap-use-after-free in xf_clipboard_format_equal
- CVE-2026-25959FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_
- CVE-2026-25955FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
- CVE-2026-25954FreeRDP has heap-use-after-free in xf_rail_server_local_move_size