FreeRDP versions from 3.14.1 up to but not including 3.32.0 contain an integer underflow vulnerability in the WinPR BMP writer. This flaw arises from a mismatched stride calculation that passes a very large value (SIZE_MAX - 3) to a function handling sub-byte images. An attacker controlling an RDP clipboard peer can exploit this by sending a specially crafted 1-bpp BMP image, which is processed by the clipboard image synthesis function, potentially causing the client to crash or suffer an out-of-bounds write.
FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a heap out-of-bounds write vulnerability in the server hash-callback NTLM authentication path. This flaw arises from failure to properly validate the MIC offset, allowing unauthenticated attackers to send a crafted AUTHENTICATE_MESSAGE that writes 16 zero bytes beyond the allocated memory.
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
CVE-2026-109942 is a NULL pointer dereference vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the rdg_process_close_packet function when processing a header-only CLOSE_CHANNEL packet without payload validation. A malicious or compromised RD Gateway can send a crafted packet to crash the FreeRDP client.
CVE-2026-109941 is an infinite loop vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the http_chunked_read function, where malicious RD Gateways can send incomplete chunked HTTP responses that cause the client to hang by looping indefinitely on zero-byte reads. This results in the client decoder thread freezing and denial of service.
A stack-based buffer overflow vulnerability exists in FreeRDP versions 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support. The flaw occurs in the wprintKeyName() function of WinPR's NCrypt PKCS#11 provider, which hex-encodes a key's CKA_ID into a fixed 128-byte stack buffer. If an attacker supplies a malicious PKCS#11 token or module with a key and matching certificate using a 55- to 64-byte CKA_ID, it can overflow the stack during key enumeration and cause a client crash.
CVE-2026-109939 is a NULL pointer dereference vulnerability in FreeRDP versions 3.27.1 before 3.32.0. It occurs in the update_read_cache_bitmap_v3_order() function when the client bitmap cache is accessed without being initialized, triggered by a malicious or compromised RDP server sending a Cache Bitmap V3 order during connection setup. This affects clients using the non-default Bitmap Cache V3 feature and can cause the client to crash.
CVE-2026-109938 is an integer overflow or wraparound vulnerability in FreeRDP version 3.11.0. This flaw occurs due to positive mapped-video coordinates overflowing, which can cause the FreeRDP client to abort. A malicious or compromised RDP server can exploit this vulnerability to terminate the client session when video redirection is enabled.
FreeRDP versions before 3.32.0 have a double-free vulnerability in the function nsc_context_initialize_encode(). This flaw occurs after a partial buffer growth failure, leaving dangling plane pointers. An attacker using a specially crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger an allocation failure, causing the server to crash during context teardown. The vulnerability has a CVSS score of 5.9 and is classified as high severity due to its potential to cause denial of service.
FreeRDP versions 3.10.0 through 3.32.2 contain a heap buffer overflow vulnerability in the WinPR png_write_data callback. This flaw occurs when a malicious RDP clipboard peer supplies a large CF_DIB image that triggers an out-of-bounds memcpy during PNG conversion, causing the client to crash. The vulnerability requires user interaction and a high attack complexity, with no impact on confidentiality or integrity but causing denial of service.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain an integer truncation vulnerability in the license_check_stream_length function. This flaw allows a malicious RDP server to send a specially crafted SERVER_LICENSE_REQUEST with a large scopeCount value that bypasses length checks. On 32-bit clients, this triggers a heap buffer overflow, potentially leading to denial of service or remote code execution.
FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain a NULL pointer dereference vulnerability in the RDPEAR NDR reader. This flaw allows malicious servers to crash FreeRDP clients by sending specially crafted truncated KERB_RPC_INTERNAL_NAME data. The issue arises when a CreateApReqAuthenticatorReq message with a NameCount of two or more ends before the Names pointer, causing a null pointer dereference during cleanup and terminating the client application.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain a heap out-of-bounds read vulnerability in the function freerdp_assistance_parse_all_elements_of(). This occurs because the parsing cursor advances without properly reducing the remaining length, allowing the scan window to exceed the decrypted ConnectionString2 buffer. An attacker can exploit this by supplying a crafted .msrcIncident invitation file and password, causing the xfreerdp client to crash upon opening the file, before any RDP connection is established.
FreeRDP versions prior to 3.32.0 contain a heap buffer overflow vulnerability in the collect_keys() function. This flaw allows local attackers controlling smartcard tokens to write beyond the fixed 64-entry keys array during PKCS#11 key enumeration. By presenting more than 64 public key objects across multiple slots, attackers can corrupt heap memory with attacker-controlled data during smartcard logon.
FreeRDP versions from 2.1.0 up to but not including 3.32.0 contain a use-after-free vulnerability in the static rdpsnd channel disconnect path. This flaw occurs when a malicious RDP server disconnects during asynchronous Wave2 playback, causing the client to access freed heap memory and potentially crash. The vulnerability has a medium severity rating with a CVSS score of 5.9.
FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers. This flaw occurs because the code checks value length before consuming alignment padding, allowing malicious or compromised RDP servers to send crafted unaligned RDPEAR payloads. Such payloads, including CreateApReqAuthenticatorReq messages, can cause the client process to over-read memory and potentially crash. The vulnerability affects clients using Remote Credential Guard. The CVSS score is 5.3, indicating medium severity, with no confidentiality or integrity impact but a potential denial of service via client crash. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
FreeRDP versions before 3.32.0 have a vulnerability where the server-supplied signed MS-RDPEGT geometry origin is stored unchecked in an unsigned video surface coordinate. This causes the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped. A malicious RDP server can exploit this by sending a negative topLevelLeft value to clients connecting with the /video option, leading to an out-of-bounds write of decoded H.264 picture data or a client abort.
FreeRDP versions from 3.11.0 up to but not including 3.32.1 contain a reachable assertion vulnerability in the urb_isoch_transfer function. This flaw allows a malicious RDP server to crash the client by sending a specially crafted OutputBufferSize value that exceeds INT32_MAX. The vulnerability triggers an assertion failure in libusb_udev_isoch_transfer, causing client termination. The CVSS score is 3.1, indicating low severity, with no confidentiality or integrity impact, only availability impact due to client crash.
FreeRDP versions before 3.32.0 have a path traversal vulnerability in the function convert_filedescriptors_to_file_list(). This flaw allows a malicious RDP server to manipulate clipboard data such that the client user may inadvertently copy arbitrary local files instead of the intended remote files. The vulnerability arises because the code concatenates server-supplied file names into local file URIs without properly sanitizing path traversal sequences like '../'.