Skip to content
OpenAdvisories
High WID-SEC-2026-2384 23 CVEs

FreeRDP: Mehrere Schwachstellen

Published Jul 15, 2026 · Updated Sep 28, 2026 · Revision 23 · de-DE

Vendor: amazon Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: Rocky Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 23

  • Critical 9.8
    CVE-2026-66402

    FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN str…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2026-67289

    FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.4
    CVE-2026-67305

    FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr

    FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP…

    FreeRDP FreeRDP
  • High 8.8
    CVE-2026-44421

    FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destinatio…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67288

    FreeRDP before 3.29.0 Denial of Service via smartcard cache

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67290

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

    FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by read…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67291

    FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67296

    FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

    FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared bod…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67297

    FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

    FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67298

    FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67299

    FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67300

    FreeRDP before 3.29.0 Use-After-Free via async message proxy

    FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted upda…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67301

    FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-67304

    FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-68580

    FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.3
    CVE-2026-67295

    FreeRDP before 3.29.0 Path Traversal via drive redirection

    FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sib…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2026-67294

    FreeRDP before 3.29.0 TLS Certificate EKU Bypass

    FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.4
    CVE-2026-67306

    FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE

    FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is boun…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.4
    CVE-2026-69159 Rejected

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE…

  • Medium 4.3
    CVE-2026-67302

    FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-67303

    FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

    FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_D…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.2
    CVE-2026-67293

    FreeRDP before 3.29.0 Improper Certificate Hostname Validation

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 2.1
    CVE-2026-66401

    FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264

    FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

Revision history

  1. #23

    Neue Updates von Oracle Linux aufgenommen

  2. #22

    Neue Updates von Red Hat aufgenommen

  3. #21

    Neue Updates von Red Hat aufgenommen

  4. #20

    Neue Updates von Red Hat aufgenommen

  5. #19

    Neue Updates von Red Hat aufgenommen

  6. #18

    Neue Updates von Oracle Linux aufgenommen

  7. #17

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  8. #16

    Neue Updates von Red Hat, Oracle Linux, Fedora und Rocky Enterprise Software Foundation aufgenommen

  9. #15

    Neue Updates von Amazon, Red Hat und Rocky Enterprise Software Foundation aufgenommen

  10. #14

    Neue Updates von Red Hat aufgenommen

  11. #13

    Neue Updates von Red Hat aufgenommen

  12. #12

    Neue Updates von Red Hat aufgenommen

  13. #11

    Referenz(en) aufgenommen: CVE-2026-69159, EUVD-2026-62673

  14. #10

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  15. #9

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  16. #8

    Neue Updates von Red Hat aufgenommen

  17. #7

    Neue Updates von SUSE aufgenommen

  18. #6

    Referenz(en) aufgenommen: CVE-2026-67289, EUVD-2026-51840, CVE-2026-67300, EUVD-2026-51821, CVE-2026-67298, EUVD-2026-51824, CVE-2026-67301, EUVD-2026-51857, CVE-2026-67294, EUVD-2026-51842, CVE-2026-67293, EUVD-2026-51860, CVE-2026-67305, EUVD-2026-51862, CVE-2026-67299, EUVD-2026-51820, CVE-2026-66402, EUVD-2026-51851, CVE-2026-67288, EUVD-2026-51819, CVE-2026-67303, EUVD-2026-51818, CVE-2026-67302, EUVD-2026-51834, CVE-2026-67306, EUVD-2026-51835, CVE-2026-67297, GHSA-43RQ-PV9M-43RF, EUVD-2026-51856, CVE-2026-68580, EUVD-2026-51990, CVE-2026-67296, EUVD-2026-51844, EUVD-2026-51811, CVE-2026-67291, EUVD-2026-51823, CVE-2026-66401, EUVD-2026-51831, CVE-2026-67295, EUVD-2026-51817, CVE-2026-67290, EUVD-2026-51865

  19. #5

    Neue Updates von Ubuntu aufgenommen

  20. #4

    Neue Updates von Red Hat aufgenommen

  21. #3

    PoC für CVE-2026-44421 aufgenommen

  22. #2

    Referenz aufgenommen GHSA-69xf-pqrw-596x

  23. #1

    Initiale Fassung

References