Skip to content
OpenAdvisories
High WID-SEC-2026-4068 15 CVEs

FreeRDP: Mehrere Schwachstellen

Published Oct 20, 2026 · Updated Nov 4, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren und offenzulegen sowie möglicherweise beliebigen Code auszuführen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 15

  • Critical 9.8
    CVE-2026-121952

    FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

    FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to …

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Critical 9.8
    CVE-2026-121953

    FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

    FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can o…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 8.8
    CVE-2026-121958

    FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

    FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 8.1
    CVE-2026-121962

    FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

    FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121951

    FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

    FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121955

    FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, t…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121956

    FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

    FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a c…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121957

    FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

    FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending …

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121960

    FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

    FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • High 7.5
    CVE-2026-121964

    FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

    FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining cap…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-121950

    FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap

    FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-121954

    FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

    FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an over…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 6.5
    CVE-2026-121959

    FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

    FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a clie…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 5.9
    CVE-2026-121961

    FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to …

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu
  • Medium 5.9
    CVE-2026-121963

    FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then c…

    FreeRDP FreeRDP freerdp2 freerdp Debian Ubuntu

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-121958, EUVD-2026-116958, CVE-2026-121956, EUVD-2026-116956, CVE-2026-121950, EUVD-2026-116950, CVE-2026-121951, EUVD-2026-116951, CVE-2026-121952, EUVD-2026-116952, CVE-2026-121964, EUVD-2026-116964, CVE-2026-121963, EUVD-2026-116963, CVE-2026-121953, EUVD-2026-116953, CVE-2026-121954, EUVD-2026-116954, CVE-2026-121955, EUVD-2026-116955, CVE-2026-121962, EUVD-2026-116962, CVE-2026-121961, EUVD-2026-116961, CVE-2026-121960, EUVD-2026-116960, CVE-2026-121959, EUVD-2026-116959, CVE-2026-121957, EUVD-2026-116957

  2. #1

    Initiale Fassung

References