Freerdp: 21 Vulnerabilities Disclosed Together, Patch Released in 3.29.0
A batch of 21 vulnerabilities affecting Freerdp, patched in version 3.29.0, spans critical issues like buffer overflows, memory corruption, and certificate validation flaws.
Key findings
- 21 vulnerabilities disclosed in Freerdp, patched in version 3.29.0.
- Flaws include buffer overflows, out-of-bounds reads, null pointer dereferences, and TLS certificate validation issues.
- Multiple vulnerabilities stem from improper handling of data lengths and buffer sizes.
- Certificate validation weaknesses could enable man-in-the-middle attacks.
- Affected versions include all prior to 3.29.0, with specific mentions of <= 3.28.0.
On August 2, 2026, a significant batch of 21 vulnerabilities was disclosed in the Freerdp remote desktop protocol client, all patched in version 3.29.0. These vulnerabilities, primarily affecting older versions up to 3.28.0, span a range of critical issues including buffer overflows, out-of-bounds reads, null pointer dereferences, and certificate validation weaknesses. The sheer volume and variety of these flaws highlight a broad security concern within the Freerdp codebase, potentially exposing users to various attack vectors including denial of service and information disclosure.
Several vulnerabilities stem from improper handling of data lengths and buffer sizes. CVE-2026-67292 describes a buffer over-disclosure in the gateway WebSocket transport where a fixed-size response stream is reused without proper length validation. Similarly, CVE-2026-67301 and CVE-2026-67291 detail out-of-bounds read vulnerabilities in the async update message proxy for drawing orders, where server-controlled sizes are not adequately checked. CVE-2026-67298 and CVE-2026-67305 also involve heap buffer overflows due to insufficient validation of peer-controlled lengths in the server-side RAIL channel handler and the clipboard virtual channel, respectively. CVE-2026-67297 points to a failure in enforcing response size limits for chunked HTTP responses, potentially leading to memory exhaustion.
Memory corruption vulnerabilities are prevalent, with multiple instances of out-of-bounds reads and null pointer dereferences. CVE-2026-66401 details an out-of-bounds heap read in the UVC H.264 extension-unit parser, while CVE-2026-67290 describes a heap out-of-bounds read in the TSMF FFmpeg decoder. Null pointer dereferences occur in smartcard functionality, as seen in CVE-2026-67304 and CVE-2026-67288, triggered by malformed requests. CVE-2026-67299 and CVE-2026-67300 highlight client-side heap use-after-free vulnerabilities in the async update message proxy for window state and icon updates.
Security weaknesses in certificate validation and handling are also addressed. CVE-2026-67294 indicates improper validation of the Extended Key Usage (EKU) purpose of peer certificates during TLS authentication. CVE-2026-67293 and CVE-2026-66402 point to multiple TLS certificate identity validation weaknesses, including improper hostname matching and custom string matching that bypasses OpenSSL's length-aware identity checks. These flaws could allow for man-in-the-middle attacks if not properly mitigated.
Other notable vulnerabilities include a divide-by-zero vulnerability in the rdpecam camera redirection client (CVE-2026-67302), improper validation of CRLF and control characters in the RDP redirection TargetNetAddress field (CVE-2026-67289), and a denial of service vulnerability in the RDPEI server channel handler (CVE-2026-67296). CVE-2026-67303 describes a reachable assertion in serial device redirection when handling unsupported IOCTL requests. Finally, CVE-2026-67295 highlights issues with drive redirection path validation, potentially allowing access to files outside the configured shared root.
All 21 vulnerabilities were patched in Freerdp version 3.29.0. Users are strongly advised to update to this version or later to mitigate the risks associated with these numerous security flaws. The coordinated disclosure of these issues underscores the importance of timely patching for remote desktop software, which often serves as a critical entry point for attackers.
The comprehensive nature of this batch suggests a need for thorough code auditing and robust security practices within the Freerdp development process. Users should remain vigilant for any further security advisories related to Freerdp and ensure their installations are kept up-to-date. The wide range of affected components, from core protocols to specific channel handlers, indicates that a systemic approach to security is necessary.