Skip to content
OpenAdvisories
Medium WID-SEC-2026-3057 23 CVEs

FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Aug 26, 2026 · Updated Nov 11, 2026 · Revision 14 · de

Vendor: amazon Vendor: Oracle Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Linux Product: Linux 2 Product: Rocky Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 23

  • Critical 9.3
    CVE-2026-91949

    FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

    FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive ne…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 8.8
    CVE-2026-111380

    FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

    FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.8
    CVE-2026-91964

    FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

    FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-91947

    FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

    FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.5
    CVE-2026-91948

    FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

    FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-91955

    FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions

    FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-b…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.6
    CVE-2026-91958

    FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index

    FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-85089

    FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

    FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_in…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91945

    FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR

    FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMP…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-91946

    FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

    FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory includ…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91950

    FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFF…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91951

    FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc

    FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write pas…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-91952

    FreeRDP before 3.31.0 Denial of Service via pool_decode_rect

    FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-91953

    FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

    FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91954

    FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

    FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to us…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91956

    FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

    FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGUR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91959

    FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

    FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91960

    FreeRDP before 3.31.0 Integer Overflow Double Free

    FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended p…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-91961

    FreeRDP before 3.31.0 Denial of Service via URBDRC

    FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with Outpu…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-91963

    FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

    FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and e…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.3
    CVE-2026-91962

    FreeRDP before 3.31.0 Integer Overflow via audin Apple backends

    FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wra…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.4
    CVE-2026-85090

    FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444

    FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an o…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 3.1
    CVE-2026-91957

    FreeRDP before 3.31.0 Use-After-Free via smartcard worker

    FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer dealloc…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

Revision history

  1. #14

    Neue Updates von Red Hat aufgenommen

  2. #13

    Neue Updates von Red Hat aufgenommen

  3. #12

    Referenz(en) aufgenommen: CVE-2026-111380, EUVD-2026-102561

  4. #11

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

  5. #10

    Neue Updates von Oracle Linux aufgenommen

  6. #9

    Neue Updates von Rocky Enterprise Software Foundation, Red Hat und Oracle Linux aufgenommen

  7. #8

    Neue Updates von Red Hat aufgenommen

  8. #7

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  9. #6

    Neue Updates von Red Hat aufgenommen

  10. #5

    Neue Updates von Red Hat und Oracle Linux aufgenommen

  11. #4

    Neue Updates von Amazon aufgenommen

  12. #3

    Referenz(en) aufgenommen: CVE-2026-91949, EUVD-2026-78806, CVE-2026-91953, EUVD-2026-78810, CVE-2026-91959, GHSA-C7QQ-9MG2-CCX2, CVE-2026-91957, EUVD-2026-78633, CVE-2026-91956, EUVD-2026-78632, CVE-2026-91954, EUVD-2026-78630, CVE-2026-91955, EUVD-2026-78631, CVE-2026-91958, EUVD-2026-78634, EUVD-2026-78635, CVE-2026-91960, EUVD-2026-78636, CVE-2026-91961, EUVD-2026-78637, CVE-2026-91962, EUVD-2026-78638, CVE-2026-91963, EUVD-2026-78639, CVE-2026-91964, EUVD-2026-78640, CVE-2026-91945, EUVD-2026-78802, CVE-2026-91946, EUVD-2026-78803, CVE-2026-91947, EUVD-2026-78804, CVE-2026-91948, EUVD-2026-78805, CVE-2026-91950, EUVD-2026-78807, CVE-2026-91951, EUVD-2026-78808, CVE-2026-91952, EUVD-2026-78809

  13. #2

    Referenz(en) aufgenommen: CVE-2026-85090, EUVD-2026-70300, CVE-2026-85089, EUVD-2026-70299

  14. #1

    Initiale Fassung

References