BugRater
Early access. This site has moved to bugrater.com.

Security releases

FreeRDP

FreeRDP Security Releases - October 2026

freerdp-2026-10 Oct 1, 2026 Source: Vendor

FreeRDP security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-109240
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

171 lines
All 171 CVEs 171 Additional recognition 0 Unclaimed only
Showing 51–100 of 171 matching , page 2 of 4 , clear filters
CVE-2026-109940 BR2026-0000-028249 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which c...
Credited as skigeek16
CVE-2026-109941 BR2026-0000-028250 FreeRDP unclaimed
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers c...
Credited as Kushalkhemka
CVE-2026-109941 BR2026-0000-028251 FreeRDP unclaimed
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers c...
Credited as opensec-intelligence
CVE-2026-109941 BR2026-0000-028252 FreeRDP unclaimed
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers c...
Credited as mayank-jangid-moon
CVE-2026-109941 BR2026-0000-028253 FreeRDP unclaimed
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers c...
Credited as skigeek16
CVE-2026-109942 BR2026-0000-028254 FreeRDP unclaimed
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL p...
Credited as Kushalkhemka
CVE-2026-109942 BR2026-0000-028255 FreeRDP unclaimed
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL p...
Credited as opensec-intelligence
CVE-2026-109942 BR2026-0000-028256 FreeRDP unclaimed
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL p...
Credited as mayank-jangid-moon
CVE-2026-109942 BR2026-0000-028257 FreeRDP unclaimed
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL p...
Credited as skigeek16
CVE-2026-109943 BR2026-0000-028258 FreeRDP unclaimed
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so ...
Credited as Kushalkhemka
CVE-2026-109943 BR2026-0000-028259 FreeRDP unclaimed
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so ...
Credited as opensec-intelligence
CVE-2026-109943 BR2026-0000-028260 FreeRDP unclaimed
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so ...
Credited as mayank-jangid-moon
CVE-2026-109943 BR2026-0000-028261 FreeRDP unclaimed
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so ...
Credited as skigeek16
CVE-2026-109944 BR2026-0000-028262 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context ...
Credited as Kushalkhemka
CVE-2026-109944 BR2026-0000-028263 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context ...
Credited as mayank-jangid-moon
CVE-2026-109944 BR2026-0000-028264 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context ...
Credited as skigeek16
CVE-2026-109944 BR2026-0000-028265 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context ...
Credited as opensec-intelligence
CVE-2026-109945 BR2026-0000-028266 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malic...
Credited as Kushalkhemka
CVE-2026-109945 BR2026-0000-028267 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malic...
Credited as mayank-jangid-moon
CVE-2026-109945 BR2026-0000-028268 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malic...
Credited as skigeek16
CVE-2026-109945 BR2026-0000-028269 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malic...
Credited as opensec-intelligence
CVE-2026-109946 BR2026-0000-028270 FreeRDP unclaimed
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or c...
Credited as Kushalkhemka
CVE-2026-109946 BR2026-0000-028271 FreeRDP unclaimed
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or c...
Credited as mayank-jangid-moon
CVE-2026-109946 BR2026-0000-028272 FreeRDP unclaimed
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or c...
Credited as skigeek16
CVE-2026-109946 BR2026-0000-028273 FreeRDP unclaimed
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or c...
Credited as opensec-intelligence
CVE-2026-109947 BR2026-0000-028274 FreeRDP unclaimed
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests...
Credited as Kushalkhemka
CVE-2026-109947 BR2026-0000-028275 FreeRDP unclaimed
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests...
Credited as opensec-intelligence
CVE-2026-109947 BR2026-0000-028276 FreeRDP unclaimed
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests...
Credited as mayank-jangid-moon
CVE-2026-109947 BR2026-0000-028277 FreeRDP unclaimed
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests...
Credited as skigeek16
CVE-2026-109948 BR2026-0000-028278 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCard...
Credited as Kushalkhemka
CVE-2026-109948 BR2026-0000-028279 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCard...
Credited as opensec-intelligence
CVE-2026-109948 BR2026-0000-028280 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCard...
Credited as mayank-jangid-moon
CVE-2026-109948 BR2026-0000-028281 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCard...
Credited as skigeek16
CVE-2026-109949 BR2026-0000-028282 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A mali...
Credited as Kushalkhemka
CVE-2026-109949 BR2026-0000-028283 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A mali...
Credited as opensec-intelligence
CVE-2026-109949 BR2026-0000-028284 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A mali...
Credited as mayank-jangid-moon
CVE-2026-109949 BR2026-0000-028285 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A mali...
Credited as skigeek16
CVE-2026-109950 BR2026-0000-028286 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling th...
Credited as Kushalkhemka
CVE-2026-109950 BR2026-0000-028287 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling th...
Credited as opensec-intelligence
CVE-2026-109950 BR2026-0000-028288 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling th...
Credited as mayank-jangid-moon
CVE-2026-109950 BR2026-0000-028289 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling th...
Credited as skigeek16
CVE-2026-109951 BR2026-0000-028290 FreeRDP unclaimed
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to...
Credited as jimaf
CVE-2026-109952 BR2026-0000-028291 FreeRDP unclaimed
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a sec...
Credited as DavidKorczynski
CVE-2026-109953 BR2026-0000-028292 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext ...
Credited as DavidKorczynski
CVE-2026-110829 BR2026-0000-031362 FreeRDP unclaimed
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send...
Credited as Kushalkhemka
CVE-2026-110829 BR2026-0000-031363 FreeRDP unclaimed
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send...
Credited as mayank-jangid-moon
CVE-2026-110829 BR2026-0000-031364 FreeRDP unclaimed
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send...
Credited as skigeek16
CVE-2026-110829 BR2026-0000-031365 FreeRDP unclaimed
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send...
Credited as opensec-intelligence
CVE-2026-110830 BR2026-0000-031366 FreeRDP unclaimed
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE...
Credited as Kushalkhemka
CVE-2026-110830 BR2026-0000-031367 FreeRDP unclaimed
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE...
Credited as mayank-jangid-moon