What is CVE-2018-8787?

CVE-2018-8787 is a critical-severity vulnerability in Check Point Software Technologies Ltd. Freerdp, classified under Integer Overflow to Buffer Overflow. CVSS score: 9.8/10. Published 2018-11-29.

How severe is CVE-2018-8787?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Check Point Software Technologies Ltd. Freerdp

CVE-2018-8787

FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.

Published 2018-11-29 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.084 (94.8th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.084 · newest: 0.084 · change: 0.000

Affected products

Check Point Software Technologies Ltd. Freerdp — versions All versions prior to 2.0.0-rc4
Freerdp — versions 2.0.0
Canonical Ubuntu Linux — versions 14.04, 16.04, 18.04
Debian Linux — versions 8.0
Red Hat Enterprise Linux Desktop — versions 7.0
Red Hat Enterprise Linux Eus — versions 7.6
Red Hat Enterprise Linux Server — versions 7.0
Red Hat Enterprise Linux Server Aus — versions 7.6
Red Hat Enterprise Linux Server Tus — versions 7.6
Red Hat Enterprise Linux Workstation — versions 7.0

Weakness classification (CWE)

References

www.securityfocus.com/bid/106938 (VDB Entry, Third Party Advisory, vdb-entry)
lists.debian.org/debian-lts-announce/2019/02/msg00015.html (mailing-list, Mailing List, Third Party Advisory)
usn.ubuntu.com/3845-1/ (vendor-advisory, Third Party Advisory)
research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/ (Exploit, Third Party Advisory)
github.com/FreeRDP/FreeRDP/commit/09b9d4f1994a674c4ec85b4947aa656eda1aed8a (Patch, Vendor Advisory)
access.redhat.com/errata/RHSA-2019:0697 (vendor-advisory, Third Party Advisory)
usn.ubuntu.com/3845-2/ (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2018-8787?: CVE-2018-8787 is a critical-severity vulnerability in Check Point Software Technologies Ltd. Freerdp, classified under Integer Overflow to Buffer Overflow. CVSS score: 9.8/10. Published 2018-11-29.
How severe is CVE-2018-8787?: Critical severity. CVSS v3 base score is 9.8 out of 10.