BugRater
Early access. This site has moved to bugrater.com.

Security releases

FreeRDP

FreeRDP Security Releases - October 2026

freerdp-2026-10 Oct 1, 2026 Source: Vendor

FreeRDP security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-109240
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

171 lines
All 171 CVEs 171 Additional recognition 0 Unclaimed only
Showing 101–150 of 171 matching , page 3 of 4 , clear filters
CVE-2026-110830 BR2026-0000-031368 FreeRDP unclaimed
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE...
Credited as skigeek16
CVE-2026-110830 BR2026-0000-031369 FreeRDP unclaimed
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE...
Credited as opensec-intelligence
CVE-2026-110831 BR2026-0000-031370 FreeRDP unclaimed
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size...
Credited as Kushalkhemka
CVE-2026-110831 BR2026-0000-031371 FreeRDP unclaimed
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size...
Credited as mayank-jangid-moon
CVE-2026-110831 BR2026-0000-031372 FreeRDP unclaimed
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size...
Credited as skigeek16
CVE-2026-110831 BR2026-0000-031373 FreeRDP unclaimed
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size...
Credited as opensec-intelligence
CVE-2026-110832 BR2026-0000-031374 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Att...
Credited as Kushalkhemka
CVE-2026-110832 BR2026-0000-031375 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Att...
Credited as mayank-jangid-moon
CVE-2026-110832 BR2026-0000-031376 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Att...
Credited as skigeek16
CVE-2026-110832 BR2026-0000-031377 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Att...
Credited as opensec-intelligence
CVE-2026-110833 BR2026-0000-031378 FreeRDP unclaimed
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by co...
Credited as Kushalkhemka
CVE-2026-110833 BR2026-0000-031379 FreeRDP unclaimed
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by co...
Credited as mayank-jangid-moon
CVE-2026-110833 BR2026-0000-031380 FreeRDP unclaimed
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by co...
Credited as skigeek16
CVE-2026-110833 BR2026-0000-031381 FreeRDP unclaimed
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by co...
Credited as opensec-intelligence
CVE-2026-110834 BR2026-0000-031382 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP...
Credited as Kushalkhemka
CVE-2026-110834 BR2026-0000-031383 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP...
Credited as mayank-jangid-moon
CVE-2026-110834 BR2026-0000-031384 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP...
Credited as skigeek16
CVE-2026-110834 BR2026-0000-031385 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP...
Credited as opensec-intelligence
CVE-2026-110835 BR2026-0000-031386 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect...
Credited as Kushalkhemka
CVE-2026-110835 BR2026-0000-031387 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect...
Credited as mayank-jangid-moon
CVE-2026-110835 BR2026-0000-031388 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect...
Credited as skigeek16
CVE-2026-110835 BR2026-0000-031389 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect...
Credited as opensec-intelligence
CVE-2026-110836 BR2026-0000-031390 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers con...
Credited as Kushalkhemka
CVE-2026-110836 BR2026-0000-031391 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers con...
Credited as mayank-jangid-moon
CVE-2026-110836 BR2026-0000-031392 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers con...
Credited as skigeek16
CVE-2026-110836 BR2026-0000-031393 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers con...
Credited as opensec-intelligence
CVE-2026-110837 BR2026-0000-031394 FreeRDP unclaimed
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a by...
Credited as Kushalkhemka
CVE-2026-110837 BR2026-0000-031395 FreeRDP unclaimed
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a by...
Credited as mayank-jangid-moon
CVE-2026-110837 BR2026-0000-031396 FreeRDP unclaimed
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a by...
Credited as skigeek16
CVE-2026-110837 BR2026-0000-031397 FreeRDP unclaimed
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a by...
Credited as opensec-intelligence
CVE-2026-110838 BR2026-0000-031398 FreeRDP unclaimed
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers ca...
Credited as Kushalkhemka
CVE-2026-110838 BR2026-0000-031399 FreeRDP unclaimed
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers ca...
Credited as mayank-jangid-moon
CVE-2026-110838 BR2026-0000-031400 FreeRDP unclaimed
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers ca...
Credited as skigeek16
CVE-2026-110838 BR2026-0000-031401 FreeRDP unclaimed
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers ca...
Credited as opensec-intelligence
CVE-2026-110839 BR2026-0000-031402 FreeRDP unclaimed
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input compo...
Credited as Kushalkhemka
CVE-2026-110839 BR2026-0000-031403 FreeRDP unclaimed
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input compo...
Credited as mayank-jangid-moon
CVE-2026-110839 BR2026-0000-031404 FreeRDP unclaimed
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input compo...
Credited as skigeek16
CVE-2026-110839 BR2026-0000-031405 FreeRDP unclaimed
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input compo...
Credited as opensec-intelligence
CVE-2026-111373 BR2026-0000-033161 FreeRDP unclaimed
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload le...
Credited as w226688
CVE-2026-111374 BR2026-0000-033162 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a St...
Credited as Kushalkhemka
CVE-2026-111374 BR2026-0000-033163 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a St...
Credited as mayank-jangid-moon
CVE-2026-111374 BR2026-0000-033164 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a St...
Credited as skigeek16
CVE-2026-111374 BR2026-0000-033165 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a St...
Credited as opensec-intelligence
CVE-2026-111375 BR2026-0000-033166 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated w...
Credited as Kushalkhemka
CVE-2026-111375 BR2026-0000-033167 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated w...
Credited as mayank-jangid-moon
CVE-2026-111375 BR2026-0000-033168 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated w...
Credited as skigeek16
CVE-2026-111375 BR2026-0000-033169 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated w...
Credited as opensec-intelligence
CVE-2026-111376 BR2026-0000-033170 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via sh...
Credited as Kushalkhemka
CVE-2026-111376 BR2026-0000-033171 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via sh...
Credited as mayank-jangid-moon
CVE-2026-111376 BR2026-0000-033172 FreeRDP unclaimed
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via sh...
Credited as skigeek16