FreeRDP versions from 2.0.0 up to but not including 3.32.0 have a vulnerability in their proxy component where improper TLS certificate validation occurs if no verification module is configured. This allows network attackers positioned between the proxy and the RDP target to present a self-signed or incorrect hostname certificate, impersonate the target, and intercept proxied session data. The issue is fixed in version 3.32.0.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain a null-pointer dereference vulnerability in the smartcard emulation backend. This occurs when a malicious RDP server sends a crafted reader-state entry with a null per-reader name in SCardGetStatusChange requests, causing the client process to crash due to strcmp or _wcscmp operations on a null pointer. The issue is fixed in version 3.32.0.
CVE-2026-114045 is a heap-based buffer overflow vulnerability in FreeRDP versions before 3.32.1. It occurs in the server-side rdpsnd channel due to an integer wraparound in the rdpsnd_server_select_format() function's DVI_ADPCM block-alignment arithmetic. A malicious RDP client can exploit this by sending two SNDC_FORMATS PDUs with an nBlockAlign value too small for nChannels, causing an unbounded heap write during server audio playback. This may enable remote code execution on the server.
FreeRDP versions before 3.32.1 contain a heap out-of-bounds read vulnerability in the Android client. This flaw allows malicious RDP servers to supply unvalidated mappedWidth and mappedHeight values in the RDPGFX_MAP_SURFACE_TO_WINDOW_PDU message. As a result, the android_UpdateWindowFromSurface function may read beyond allocated heap buffers, potentially causing application crashes or disclosure of memory contents.
CVE-2026-114043 is a heap-based out-of-bounds read vulnerability in FreeRDP versions before 3.32.1. It occurs in the clipboard PNG-to-CF_DIB synthesis code due to improper handling of low-bit-depth PNG images. A malicious RDP server can exploit this by sending a crafted clipboard payload that causes the client to disclose heap memory when pasted.
FreeRDP versions 3.32.0 contain a use-after-free vulnerability in the drdynvc channel. This flaw occurs when a pool-owned stream is freed improperly if totalLength is smaller than the chunk size. A malicious RDP server can exploit this by sending a crafted Virtual Channel PDU, causing the client to crash during teardown.
CVE-2026-114041 is a heap out-of-bounds read vulnerability in FreeRDP versions before 3.32.1 on Windows. It occurs in the client_cli_present_gateway_message function, where a byte count is incorrectly used as a wide-character printf precision. This flaw allows a malicious RD Gateway to cause the client to read beyond the intended buffer size, potentially leaking heap memory or causing a crash.
CVE-2026-111881 is an integer underflow vulnerability in FreeRDP versions from 3.14.1 up to but not including 3.32.0. The flaw exists in the WinPR BMP writer component, where an incorrect stride calculation leads to passing a very large value (SIZE_MAX - 3) to a function that zeroes memory. This occurs when processing crafted 1-bit-per-pixel BMP images from a malicious RDP clipboard peer, potentially causing a client crash or out-of-bounds memory write.
FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a heap out-of-bounds write vulnerability in the server hash-callback NTLM path. This flaw occurs due to improper validation of the MIC offset in an AUTHENTICATE_MESSAGE, allowing unauthenticated attackers to write 16 zero bytes beyond allocated memory. The issue is fixed in version 3.32.0.
FreeRDP versions from 3.29.0 up to but not including 3.32.0 contain an integer overflow vulnerability in the Apple audin backends. This flaw allows a malicious RDP server to cause a heap out-of-bounds write on macOS and iOS clients by sending a specially crafted FramesPerPacket value that wraps the buffer size calculation. The issue is fixed in version 3.32.0.
FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the Windows RAIL client. This flaw allows malicious RDP servers to cause heap over-reads by sending window titles that are not properly null-terminated. The vulnerability can lead to corruption of window titles or client crashes. A fix is available in FreeRDP version 3.32.0.
CVE-2026-110836 is a high-severity vulnerability in FreeRDP versions 3.0.0 up to but not including 3.32.0. It involves an infinite loop in the http_response_recv() function triggered by maliciously crafted Content-Type headers from a gateway. This flaw allows an attacker controlling the gateway to cause a client thread to consume full CPU indefinitely, leading to resource exhaustion. The issue is fixed in FreeRDP version 3.32.0.
CVE-2026-110831 is a resource retention vulnerability in FreeRDP versions 3.13.0 up to but not including 3.32.0. The flaw occurs in the drive_process_irp_create function, where a file descriptor or handle is registered before allocation size is applied and not removed if the operation fails. This can be exploited by a malicious RDP server sending a crafted IRP_MJ_CREATE request with an allocation size of UINT64_MAX, causing a failure that leaks the file object and OS handle until the drive is torn down.
CVE-2026-109944 is a reachable assertion vulnerability in FreeRDP versions 3.0.0 before 3.32.0. The flaw occurs because card handles are not removed when Emulate_SCardReleaseContext releases a smartcard-emulation context. This leads to a stale handle being used later by Emulate_SCardTransmit, causing the client to hit a terminating assertion and crash. A malicious RDP server can exploit this by releasing a context, establishing another, and issuing SCardTransmit with the stale handle, crashing clients with smartcard emulation and redirection enabled.
CVE-2026-109943 is a high-severity double free vulnerability in FreeRDP versions 3.29.0 before 3.32.0. It occurs in the client's async-update message proxy when handling polygon points arrays with zero points, leading to a double free during cleanup. A malicious RDP server can exploit this by sending crafted polygon orders to crash the client if async-update is enabled.
CVE-2026-109942 is a NULL pointer dereference vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the rdg_process_close_packet function when processing a header-only CLOSE_CHANNEL packet without payload validation. A malicious or compromised RD Gateway can send a crafted packet to crash the FreeRDP client.
CVE-2026-109941 is an infinite loop vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the http_chunked_read function, where malicious RD Gateways can send incomplete chunked HTTP responses that cause the client to hang by looping indefinitely on zero-byte reads. This results in the client decoder thread freezing and denial of service.
A stack-based buffer overflow vulnerability exists in FreeRDP versions 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support. The flaw occurs in the wprintKeyName() function of WinPR's NCrypt PKCS#11 provider, which hex-encodes a key's CKA_ID into a fixed 128-byte stack buffer. If an attacker supplies a malicious PKCS#11 token or module with a key and matching certificate using a 55- to 64-byte CKA_ID, it can overflow the stack during key enumeration and cause a client crash.
CVE-2026-109939 is a NULL pointer dereference vulnerability in FreeRDP versions 3.27.1 before 3.32.0. It occurs in the update_read_cache_bitmap_v3_order() function when the client bitmap cache is accessed without being initialized, triggered by a malicious or compromised RDP server sending a Cache Bitmap V3 order during connection setup. This affects clients using the non-default Bitmap Cache V3 feature and can cause the client to crash.
CVE-2026-109938 is an integer overflow or wraparound vulnerability in FreeRDP version 3.11.0. This flaw occurs due to positive mapped-video coordinates overflowing, which can cause the FreeRDP client to abort. A malicious or compromised RDP server can exploit this vulnerability to terminate the client session when video redirection is enabled.