SB2026051220 - Multiple vulnerabilities in FreeRDP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051220

SB2026051220 - Multiple vulnerabilities in FreeRDP

Published: May 12, 2026

Security Bulletin ID SB2026051220
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Use-after-free (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause client-side memory corruption.

The vulnerability exists due to use-after-free in the RDPEAR NDR parser when processing crafted RDPEAR NDR data from an RDP server. A remote attacker can reuse a non-null NDR pointer ref-id across multiple logical pointer fields to cause client-side memory corruption.

User interaction is required because the client must connect to a malicious or compromised RDP server, and exploitation is reachable when RDPEAR or Remote Credential Guard is in use.


2) Type Confusion (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to type confusion in the RDPEAR NDR parser when processing crafted RDPEAR NDR data from an RDP server. A remote attacker can reuse a non-null NDR pointer ref-id across fields with incompatible expected NDR types to cause an out-of-bounds read.

User interaction is required because the client must connect to a malicious or compromised RDP server, and exploitation is reachable when RDPEAR or Remote Credential Guard is in use.


3) Out-of-bounds write (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to out-of-bounds write in freerdp_bitmap_decompress_planar() and planar_decompress_plane_rle() in the planar bitmap decoder when decoding RLE planar data with a large destination stride and X destination coordinate that trigger the temp-buffer code path. A remote attacker can send specially crafted planar bitmap data to cause a denial of service and potentially execute arbitrary code.

No FreeRDP server or client is affected; the issue affects third-party implementations that use their own decoding system and utilize the FreeRDP planar decoder.


4) Heap-based buffer overflow (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in gdi_CacheToSurface when processing crafted RDPGFX PDUs from a server. A remote attacker can send crafted RDPGFX CacheToSurface messages to execute arbitrary code.

RDPGFX must be enabled, and user interaction is required to connect the client to an attacker-controlled RDP server.


5) Heap-based buffer overflow (CVE-ID: CVE-2026-44420)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the server-side clipboard (cliprdr) channel capability parsing routine when processing a CB_CLIP_CAPS PDU with an undersized capabilitySetLength value. A remote user can send a specially crafted CB_CLIP_CAPS PDU to execute arbitrary code.

Affected systems must have the cliprdr server channel enabled.


Remediation

Install update from vendor's website.

References