Skip to content
OpenAdvisories
High WID-SEC-2026-0514 15 CVEs

FreeRDP: Mehrere Schwachstellen

Published Feb 24, 2026 · Updated Nov 12, 2026 · Revision 37 · de

Vendor: amazon Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 15

  • High 8.8
    CVE-2026-26955

    FreeRDP has Out-of-bounds Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface co…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-26965

    FreeRDP has Out-of-bounds Write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+n…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25942

    FreeRDP has global-buffer-overflow in xf_rail_server_execute_result

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from th…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25952

    FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25953

    FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime prote…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25954

    FreeRDP has heap-use-after-free in xf_rail_server_local_move_size

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25955

    FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `surface->data`…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25959

    FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-25997

    FreeRDP has heap-use-after-free in xf_clipboard_format_equal

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-26271

    Buffer Overread in FreeRDP Icon Processing

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachab…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-26986

    FreeRDP has heap-use-after-free in rail_window_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.5
    CVE-2026-27950

    FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implemen…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 5.3
    CVE-2026-27951

    FreeRDP has possible Integer overflow in Stream_EnsureCapacity

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitati…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.0
    CVE-2026-27015

    FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-25941

    FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read

    FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP se…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

Revision history

  1. #37

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  2. #36

    Neue Updates von Red Hat aufgenommen

  3. #35

    Neue Updates von Oracle Linux aufgenommen

  4. #34

    Neue Updates von Fedora aufgenommen

  5. #33

    Neue Updates von SUSE aufgenommen

  6. #32

    Neue Updates von Ubuntu aufgenommen

  7. #31

    Neue Updates von Oracle Linux aufgenommen

  8. #30

    Referenz(en) aufgenommen: USN-8561-1

  9. #29

    Neue Updates von Oracle Linux aufgenommen

  10. #28

    Neue Updates von Oracle Linux aufgenommen

  11. #27

    Neue Updates von Oracle Linux aufgenommen

  12. #26

    Neue Updates von Oracle Linux aufgenommen

  13. #25

    Neue Updates von Oracle Linux aufgenommen

  14. #24

    Neue Updates von Red Hat aufgenommen

  15. #23

    Neue Updates von Red Hat aufgenommen

  16. #22

    Neue Updates von Red Hat aufgenommen

  17. #21

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  18. #20

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

  19. #19

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  20. #18

    Neue Updates von openSUSE aufgenommen

  21. #17

    Neue Updates von SUSE aufgenommen

  22. #16

    Neue Updates von SUSE aufgenommen

  23. #15

    Neue Updates von SUSE aufgenommen

  24. #14

    Neue Updates von openSUSE aufgenommen

  25. #13

    Neue Updates von SUSE aufgenommen

References