Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 351

Export CSV
CVE-2026-111380

FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111375

FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109680

FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-110836

FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-110831

FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111881

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111880

FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109941

FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response

FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109251

FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109246

FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109241

FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, causing client denial of service.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-109952

FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111374

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111382

FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-111377

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp