Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2021-41160 EUVD-2021-28270

Improper region checks in FreeRDP allow out of bound write to memory

Published Oct 21, 2021 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp2 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 2.4.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 freerdp2 2.4.1+dfsg1-1 —
Debian 11 freerdp2 2.3.0+dfsg1-2+deb11u2 DLA-4053-1
Debian 10 freerdp2 2.3.0+dfsg1-2+deb10u4 DLA-3654-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS freerdp2 2.3.0+dfsg1-2ubuntu2 —
Ubuntu 20.04 LTS freerdp2 2.2.0+dfsg1-0ubuntu0.20.04.2 USN-5154-1
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 18.04 LTS freerdp2 2.2.0+dfsg1-0ubuntu0.18.04.2 USN-5154-1
Ubuntu 16.04 LTS freerdp No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 freerdp +4 2:2.2.0-7.el8_5 RHSA-2021:4622
RHEL 7 freerdp +4 2.1.1-5.el7_9 RHSA-2021:4619
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.4 EUS freerdp +4 2:2.2.0-6.el8_4 RHSA-2021:4623
RHEL 8.2 EUS freerdp +4 2:2.0.0-46.rc4.el8_2.5 RHSA-2021:4621
RHEL 8.1 EUS freerdp +4 2:2.0.0-46.rc4.el8_1.5 RHSA-2021:4620

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 freerdp +4 2:2.2.0-7.el8_5 ALSA-2021:4622

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 freerdp 2:2.2.0-7.el8_5 RLSA-2021:4622

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 freerdp 2.4.0-150400.3.6.1 SUSE-SU-2022:2993-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp2 2.4.1-1.1 openSUSE-SU-2024:11591-1
openSUSE Leap 15.4 freerdp 2.4.0-150400.3.6.1 SUSE-SU-2022:2993-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 freerdp +1 2.4.1-r0 —
Alpine v3.23 freerdp +1 2.4.1-r0 —
Alpine v3.22 freerdp +1 2.4.1-r0 —
Alpine v3.21 freerdp 2.4.1-r0 —
Alpine v3.20 freerdp 2.4.1-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 freerdp 2.4.1-r0 —
Alpine v3.18 freerdp 2.4.1-r0 —
Alpine v3.17 freerdp 2.4.1-r0 —
Alpine v3.16 freerdp 2.4.1-r0 —
Alpine v3.15 freerdp 2.4.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 freerdp +4 2.1.1-5.amzn2 ALAS2-2022-1735

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 freerdp +4 2:2.2.0-7.el8_5 ELSA-2021-4622
Oracle Linux 7 freerdp +4 2.1.1-5.el7_9 ELSA-2021-4619

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Jajangjaman/CVE-2021-41160 ★ 0 · Dec 28, 2022

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected clie…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 15

References