FreeRDP versions prior to 3.32.0 contain a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server. This flaw occurs because the frame id in a client's Frame Acknowledge PDU is stored without proper range checking, leading to an underflow in the in-flight frame count. An authenticated client can exploit this by acknowledging a frame id one greater than the last frame sent, causing a divide-by-zero error that terminates the process and disconnects all viewers.
FreeRDP versions from 2.0.0 up to but not including 3.32.0 have a vulnerability in the winpr-makecert tool that creates unencrypted private keys without restricting file permissions to the owner only. This allows local users on multi-user Unix systems to read private keys from world-readable files or from PFX files protected by a default hard-coded password.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain a heap out-of-bounds read vulnerability in the WinPR clipboard function convert_filedescriptors_to_file_list(). This occurs because the function processes a server-controlled FILEDESCRIPTORW structure without ensuring NUL-termination, leading to unbounded scanning calls. A malicious RDP server can exploit this by sending a specially crafted odd-length FILEDESCRIPTORW blob, causing crashes in X11, Wayland, and SDL clients when pasting files copied from the server.
FreeRDP versions from 3.0.0 up to but not including 3.32.0 have a vulnerability due to incorrect permission assignment. This flaw allows local users on multi-user Unix systems to read private keys that should be protected, specifically those written by crypto_write_pem during soft-smartcard logon. The private keys are exposed because they are created with world-readable permissions in a shared temporary directory.
FreeRDP versions before 3.32.0 contain a vulnerability in the freerdp_http_request() function where TLS handshakes are completed without proper server certificate chain validation. This flaw allows on-path attackers to impersonate login.microsoftonline.com during the Azure AD authentication process, potentially capturing OAuth authorization codes and substituting the OpenID discovery document. The vulnerability has a CVSS score of 6.8, indicating a high severity level.
FreeRDP versions prior to 3.32.0 have a NULL pointer dereference vulnerability in the client video redirection channel. This flaw allows a malicious server to crash the client by sending out-of-order messages, specifically a Geometry CLEAR message followed by VideoData that dereferences a null pointer. The vulnerability results in a denial of service condition on the client side.
FreeRDP versions before 3.0.0 and versions 3.6.0 before 3.32.0 contain a vulnerability where uninitialized heap memory is rendered from un-decoded progressive tiles due to the tile->current buffer being allocated without zeroing. This allows a malicious RDP server to send crafted tile sequences that can cause heap bytes to be displayed on screen or cause the client process to abort. The vulnerability has a CVSS score of 7.1, indicating high severity.
FreeRDP versions before 3.32.0 have a double-free vulnerability in the nsc_context_initialize_encode() function. This flaw occurs when a partial buffer growth failure leaves dangling plane pointers, which can be triggered by a crafted RDP client negotiating NSCodec with a large desktop geometry. Exploitation causes the server to crash during context teardown.
FreeRDP versions 3.10.0 through 3.32.2 have a heap-based buffer overflow vulnerability in the WinPR png_write_data callback. This occurs when a realloc failure leads to writing past the allocated buffer. An attacker controlling the RDP clipboard can supply a large CF_DIB image that triggers an out-of-bounds memcpy during PNG conversion, causing the client to crash.
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.