Freerdp
Page 2 of 3 — Freerdp CVEs from a corpus of 236, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25942 | High | 7.5 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[… |
CVE-2026-25941 | Medium | 4.3 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an ou… |
CVE-2026-24684 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is… |
CVE-2026-24683 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without… |
CVE-2026-24682 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse… |
CVE-2026-24681 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback afte… |
CVE-2026-24680 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Fr… |
CVE-2026-24679 | Critical | 9.1 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices wit… |
CVE-2026-24678 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after… |
CVE-2026-24677 | Critical | 9.1 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not v… |
CVE-2026-24676 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thr… |
CVE-2026-24675 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code… |
CVE-2026-24491 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed… |
CVE-2026-23948 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows… |
CVE-2026-23884 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed mem… |
CVE-2026-23883 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free`… |
CVE-2026-23732 | High | 7.5 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validate… |
CVE-2026-23534 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands dec… |
CVE-2026-23533 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec de… |
CVE-2026-23532 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `g… |
CVE-2026-23531 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls… |
CVE-2026-23530 | Critical | 9.8 | 2026-01-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrc… |
CVE-2026-22859 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_I… |
CVE-2026-22858 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The ro… |
CVE-2026-22857 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by i… |
CVE-2026-22856 | High | 8.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free… |
CVE-2026-22855 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrL… |
CVE-2026-22854 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read len… |
CVE-2026-22853 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire ele… |
CVE-2026-22852 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRD… |
CVE-2026-22851 | Medium | 5.9 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SD… |
CVE-2025-68118 | Critical | 9.1 | 2025-12-17 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Wind… |
CVE-2025-4478 | Medium | 6.5 | 2025-05-16 | A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the… |
CVE-2024-32662 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs… |
CVE-2024-32661 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and cr… |
CVE-2024-32660 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid hug… |
CVE-2024-32659 | Critical | 9.8 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth… |
CVE-2024-32658 | Critical | 9.8 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5… |
CVE-2024-32460 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRD… |
CVE-2024-32459 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are v… |
CVE-2024-32458 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32041 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32040 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connecti… |
CVE-2024-32039 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to in… |
CVE-2024-22211 | Low | 3.7 | 2024-01-19 | FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_contex… |
CVE-2023-40576 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40575 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40574 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40569 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40567 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40188 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40187 | High | 7.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject… |
CVE-2023-40186 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow l… |
CVE-2023-40181 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow… |
CVE-2023-39356 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may… |
CVE-2023-39353 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset val… |
CVE-2023-39352 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset va… |
CVE-2023-39355 | High | 7.0 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x release branch before… |
CVE-2023-39354 | Medium | 5.9 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-39351 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Po… |
CVE-2023-39350 | Medium | 5.9 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow le… |
CVE-2023-40589 | Medium | 4.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflo… |
CVE-2022-39319 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A mali… |
CVE-2022-39318 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious serve… |
CVE-2022-39317 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A… |
CVE-2022-41877 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious… |
CVE-2022-39347 | Low | 2.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` c… |
CVE-2022-39320 | Medium | 5.5 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocatio… |
CVE-2022-39316 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malic… |
CVE-2022-39283 | Medium | 5.9 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized d… |
CVE-2022-39282 | Low | 3.5 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitial… |
CVE-2022-24883 | High | 7.4 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be success… |
CVE-2022-24882 | Critical | 9.1 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort… |
CVE-2021-41160 | Medium | 5.3 | 2021-10-21 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger… |
CVE-2021-41159 | Medium | 5.8 | 2021-10-21 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gate… |
CVE-2021-37595 | Critical | 9.8 | 2021-07-30 | In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE Fi… |
CVE-2021-37594 | Critical | 9.8 | 2021-07-30 | In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE Fil… |
CVE-2020-15103 | Low | 3.5 | 2020-07-27 | In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The in… |
CVE-2020-4033 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. T… |
CVE-2020-4032 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks ar… |
CVE-2020-4031 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affec… |
CVE-2020-4030 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fix… |
CVE-2020-11099 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of… |
CVE-2020-11098 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is… |
CVE-2020-11097 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-11096 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-ca… |
CVE-2020-11095 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-11089 | Low | 3.7 | 2020-05-29 | In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, print… |
CVE-2020-11088 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. |
CVE-2020-11087 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. |
CVE-2020-11086 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an intern… |
CVE-2020-11085 | Low | 2.6 | 2020-05-29 | In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bo… |
CVE-2020-11043 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on sc… |
CVE-2020-11040 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This ha… |
CVE-2020-11041 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse… |
CVE-2020-11039 | High | 8.0 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to i… |
CVE-2020-11038 | Medium | 6.9 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the cli… |
CVE-2020-11019 | Medium | 4.3 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid a… |
CVE-2020-11018 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causi… |
CVE-2020-11017 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixe… |