Skip to content
OpenAdvisories
Medium WID-SEC-2026-3603 6 CVEs

FreeRDP: Mehrere Schwachstellen

Published Sep 27, 2026 · Updated Nov 11, 2026 · Revision 5 · de

Vendor: Oracle Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Linux Product: Rocky Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen Denial of Service Angriff oder einen nicht näher spezifizierten Angriff durchzuführen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 6

  • High 8.8
    CVE-2026-114045

    FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

    FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FOR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-114041

    FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

    FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the …

    FreeRDP FreeRDP freerdp2 freerdp3 Debian
  • Medium 6.5
    CVE-2026-114042

    FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

    FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channe…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-114043

    Vulnerability in FreeRDP

    FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assum…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-114044

    FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

    FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 3.1
    CVE-2026-109240

    FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

    FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

Revision history

  1. #5

    Neue Updates von Red Hat aufgenommen

  2. #4

    Neue Updates von Red Hat, Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  3. #3

    Referenz(en) aufgenommen: CVE-2026-114043, EUVD-2026-106994, CVE-2026-114044, EUVD-2026-106995, CVE-2026-114041, EUVD-2026-106992, CVE-2026-114045, EUVD-2026-106996, CVE-2026-114042, EUVD-2026-106993

  4. #2

    Referenz(en) aufgenommen: CVE-2026-109240, EUVD-2026-97684

  5. #1

    Initiale Fassung

References