Skip to content
OpenAdvisories
Medium WID-SEC-2026-4039 23 CVEs

FreeRDP: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Nov 11, 2026 · Revision 4 · de

Vendor: Red Hat Vendor: Ubuntu Product: Enterprise Linux Product: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Angriff auszulösen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 23

  • High 7.5
    CVE-2026-121386

    FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers

    FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipbo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 7.4
    CVE-2026-121392

    FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate

    FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a c…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121388

    FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST

    FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 byte…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121393

    FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion

    FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121394

    FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder

    FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowin…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121395

    FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder

    FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121400

    FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet

    FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then s…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121402

    FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics

    FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without en…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121404

    FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

    FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx chann…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121407

    FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel

    FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-121412

    FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

    FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending f…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2026-121398

    FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module

    FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2026-121409

    FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

    FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2026-121408

    FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel

    FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP ser…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121387

    FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder

    FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 me…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121390

    FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response

    FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed u…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121391

    FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE

    FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121396

    FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion

    FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsis…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121397

    FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()

    FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121399

    FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length

    FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7F…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121401

    FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet

    FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121405

    FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

    FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request wi…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121406

    FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload

    FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX paylo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von Ubuntu aufgenommen

  3. #2

    Referenz(en) aufgenommen: CVE-2026-121386, EUVD-2026-115918, CVE-2026-121399, EUVD-2026-115931, CVE-2026-121405, EUVD-2026-115937, CVE-2026-121390, EUVD-2026-115922, CVE-2026-121391, EUVD-2026-115923, CVE-2026-121397, EUVD-2026-115929, CVE-2026-121392, EUVD-2026-115924, CVE-2026-121400, EUVD-2026-115932, CVE-2026-121401, EUVD-2026-115933, CVE-2026-121396, EUVD-2026-115928, CVE-2026-121402, EUVD-2026-115934, CVE-2026-121412, EUVD-2026-115944, CVE-2026-121394, EUVD-2026-115926, CVE-2026-121393, EUVD-2026-115925, CVE-2026-121407, EUVD-2026-115939, CVE-2026-121395, EUVD-2026-115927, CVE-2026-121404, EUVD-2026-115936, CVE-2026-121406, EUVD-2026-115938, CVE-2026-121408, EUVD-2026-115940, CVE-2026-121409, EUVD-2026-115941, CVE-2026-121388, EUVD-2026-115920, CVE-2026-121398, EUVD-2026-115930, CVE-2026-121387, EUVD-2026-115919

  4. #1

    Initiale Fassung

References