FreeRDP: Ten Vulnerabilities Disclosed Together, Ranging from Medium to High Severity
Key findings • Ten vulnerabilities in FreeRDP were disclosed on August 19, 2026, ranging from Medium to High severity. • Issues include improper buffer validation, use-after-free, division by…
Key findings
- Ten vulnerabilities in FreeRDP were disclosed on August 19, 2026, ranging from Medium to High severity.
- Issues include improper buffer validation, use-after-free, division by zero, and memory corruption in decompression, audio, and codec components.
- Several high-severity flaws related to TS Gateway and H.264 decoding could lead to RCE or DoS.
- Patches are available in versions 3.27.0 and 3.28.0, addressing the disclosed vulnerabilities.
- Users are urged to update FreeRDP to the latest versions to mitigate these security risks.
On August 19, 2026, a batch of ten vulnerabilities was disclosed for the FreeRDP remote desktop protocol implementation. These vulnerabilities, disclosed on the same day, span several components of FreeRDP and range in severity from Medium to High. The disclosures highlight potential weaknesses in how FreeRDP handles data decompression, audio formats, codec decoding, image copying, glyph caching, and data reassembly, particularly when interacting with malicious RDP servers or gateways.
Several vulnerabilities stem from improper buffer size calculations and validation. CVE-2026-69159, a Medium severity issue, arises from insufficient verification of source buffer contents in planar decompression, potentially allowing for out-of-bounds reads. Similarly, CVE-2026-55564, also Medium, involves an incorrect boundary check in the glyph cache, enabling a malicious server to exploit replay vulnerabilities. CVE-2026-55648, another Medium severity flaw, occurs due to 32-bit arithmetic overflow when calculating image dimensions for icon data, which could lead to heap corruption.
Audio and codec handling are also affected. CVE-2026-63652 (High) involves a use-after-free vulnerability in the RDP sound server when processing malformed audio format PDUs. CVE-2026-63117 (Medium) describes a scenario where an authenticated client can manipulate audio format parameters to cause a division by zero, leading to a crash. Furthermore, CVE-2026-63633 (High) points to an issue in the Opus decoder where a stream capacity is not properly ensured before writing decoded data, potentially leading to buffer overflows.
Remote Code Execution (RCE) or Denial of Service (DoS) risks are present in several high-severity vulnerabilities related to data reassembly and fragmentation. CVE-2026-55194 (High) details how FreeRDP clients do not correctly validate response reassembly stream capacity when using TS Gateway, allowing a malicious gateway to exploit this. CVE-2026-55193 (High) describes a similar issue where a malicious gateway can send oversized fragments due to an unbounded max_xmit_frag value. Additionally, CVE-2026-55192 (High) and CVE-2026-55191 (High) both involve issues with H.264 decoder backends and RDPGFX, where improper allocation sizes based on bitstream data rather than surface dimensions can lead to memory corruption or crashes.
The affected versions and patches vary across the disclosed vulnerabilities. CVE-2026-69159, CVE-2026-55564, CVE-2026-55194, CVE-2026-55193, CVE-2026-55192, and CVE-2026-55191 were fixed in version 3.27.0 or later. CVE-2026-63652, CVE-2026-63633, and CVE-2026-63117 were addressed in version 3.28.0 or later. CVE-2026-55648 was patched in version 3.27.0. Users are advised to update to the latest available versions to mitigate these risks.
This coordinated disclosure of ten vulnerabilities underscores the importance of regular updates for FreeRDP users. The range of issues, from memory corruption to potential RCE, highlights the need for vigilance against sophisticated RDP server attacks. Keeping FreeRDP updated is crucial for maintaining a secure remote desktop environment.