rpm package
almalinux/freerdp
pkg:rpm/almalinux/freerdp
Vulnerabilities (77)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68580 | Hig | 7.5 | < 2:2.11.7-11.el8_10 | 2:2.11.7-11.el8_10 | Aug 2, 2026 | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket | |
| CVE-2026-67299 | Hig | 7.5 | < 2:2.11.7-11.el8_10 | 2:2.11.7-11.el8_10 | Aug 1, 2026 | FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInf | |
| CVE-2026-67289 | Cri | 9.8 | < 2:2.11.7-11.el8_10 | 2:2.11.7-11.el8_10 | Aug 1, 2026 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written | |
| CVE-2026-64624 | Hig | 7.8 | < 2:2.11.7-11.el8_10 | 2:2.11.7-11.el8_10 | Jul 20, 2026 | FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary command | |
| CVE-2026-64621 | Hig | 7.3 | < 2:3.10.3-12.el10_2.8 | 2:3.10.3-12.el10_2.8 | Jul 20, 2026 | FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings | |
| CVE-2026-64620 | Cri | 9.8 | < 2:3.10.3-12.el10_2.8 | 2:3.10.3-12.el10_2.8 | Jul 20, 2026 | FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out | |
| CVE-2026-55827 | Hig | 7.5 | < 2:3.10.3-12.el10_2.7 | 2:3.10.3-12.el10_2.7 | Jul 10, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller | |
| CVE-2026-45700 | Cri | 9.8 | < 2:3.10.3-12.el10_2.6 | 2:3.10.3-12.el10_2.6 | May 29, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate | |
| CVE-2026-44422 | Hig | 7.5 | < 2:3.10.3-12.el10_2.6 | 2:3.10.3-12.el10_2.6 | May 29, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is | |
| CVE-2026-44421 | Hig | 8.8 | < 2:3.10.3-12.el10_2.6 | 2:3.10.3-12.el10_2.6 | May 29, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is c | |
| CVE-2026-44420 | Hig | 8.8 | < 2:3.10.3-12.el10_2.6 | 2:3.10.3-12.el10_2.6 | May 29, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can cras | |
| CVE-2026-40033 | Hig | 8.8 | < 2:3.10.3-12.el10_2.6 | 2:3.10.3-12.el10_2.6 | May 26, 2026 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unc | |
| CVE-2026-33987 | Hig | 7.1 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData poin | |
| CVE-2026-33985 | Med | 5.9 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2. | |
| CVE-2026-33984 | Hig | 7.5 | < 2:2.11.7-1.el9_7.6 | 2:2.11.7-1.el9_7.6 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels s | |
| CVE-2026-33983 | Med | 6.5 | < 2:2.11.7-1.el9_7.6 | 2:2.11.7-1.el9_7.6 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift expon | |
| CVE-2026-33982 | Hig | 7.1 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 30, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2. | |
| CVE-2026-31885 | Med | 6.5 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0. | |
| CVE-2026-31884 | Med | 6.5 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common | |
| CVE-2026-31883 | Med | 6.5 | < 2:3.10.3-5.el10_1.8 | 2:3.10.3-5.el10_1.8 | Mar 13, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtr |
- affected < 2:2.11.7-11.el8_10fixed 2:2.11.7-11.el8_10
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket
- affected < 2:2.11.7-11.el8_10fixed 2:2.11.7-11.el8_10
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInf
- affected < 2:2.11.7-11.el8_10fixed 2:2.11.7-11.el8_10
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written
- affected < 2:2.11.7-11.el8_10fixed 2:2.11.7-11.el8_10
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary command
- affected < 2:3.10.3-12.el10_2.8fixed 2:3.10.3-12.el10_2.8
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings
- affected < 2:3.10.3-12.el10_2.8fixed 2:3.10.3-12.el10_2.8
FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out
- affected < 2:3.10.3-12.el10_2.7fixed 2:3.10.3-12.el10_2.7
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller
- affected < 2:3.10.3-12.el10_2.6fixed 2:3.10.3-12.el10_2.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate
- affected < 2:3.10.3-12.el10_2.6fixed 2:3.10.3-12.el10_2.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is
- affected < 2:3.10.3-12.el10_2.6fixed 2:3.10.3-12.el10_2.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is c
- affected < 2:3.10.3-12.el10_2.6fixed 2:3.10.3-12.el10_2.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can cras
- affected < 2:3.10.3-12.el10_2.6fixed 2:3.10.3-12.el10_2.6
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unc
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData poin
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.
- affected < 2:2.11.7-1.el9_7.6fixed 2:2.11.7-1.el9_7.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels s
- affected < 2:2.11.7-1.el9_7.6fixed 2:2.11.7-1.el9_7.6
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift expon
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common
- affected < 2:3.10.3-5.el10_1.8fixed 2:3.10.3-5.el10_1.8
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtr
Page 1 of 4