SB2026090136 - Multiple vulnerabilities in FreeRDP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090136

SB2026090136 - Multiple vulnerabilities in FreeRDP

Published: September 1, 2026

Security Bulletin ID SB2026090136
CSH Severity
High
Patch available
YES
Number of vulnerabilities 24
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 13% Medium 63% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 24 vulnerabilities.


1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in func_get_ep_desc() in the URBDRC channel when processing a crafted SELECT_CONFIGURATION descriptor followed by a bulk or interrupt transfer request. A remote attacker can send a crafted RDP server response to cause a denial of service.

Exploitation is reachable on clients with USB redirection enabled and relies on an InterfaceNumber-to-array-position mismatch together with an unchecked AlternateSetting index.


2) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in nego_send_negotiation_request when processing a server-controlled RoutingToken during RDP negotiation after redirection. A remote attacker can send a specially crafted server redirection PDU to execute arbitrary code.

Without chaining with a separate memory leak to defeat ASLR, the issue results in a client crash. User interaction is required because the victim must connect to a malicious RDP server.


3) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the urbdrc USB redirection path when handling failed or short USB control transfer IN completions. A remote attacker can issue crafted IN transfers through a malicious RDP server to disclose sensitive information.

USB redirection must be active and a USB device must be redirected for exploitation to succeed.


4) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and potentially corrupt memory.

The vulnerability exists due to integer overflow or wraparound in the audin Apple backends when processing server-controlled audio format values during audin negotiation. A remote attacker can send a crafted MSG_SNDIN_OPEN message with a malicious FramesPerPacket value to cause a denial of service and potentially corrupt memory.

The issue affects the macOS and iOS audin backends, and on macOS the wrapped allocation size can become 4 bytes while AudioQueueAllocateBuffer() still succeeds.


5) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in URBDRC/libusb control-transfer path when processing a server-supplied URBDRC control-transfer request. A remote attacker can send a crafted request with an oversized OutputBufferSize value to cause a denial of service.

The issue is triggered when OutputBufferSize is set to 65536, and exploitation affects builds that use the URBDRC libusb path after the user connects to a malicious server.


6) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in Stream_EnsureCapacity and Stream_EnsureRemainingCapacity when processing a crafted WebSocket frame length from an RD Gateway peer. A remote attacker can send a specially crafted WebSocket Ping frame to cause a denial of service.

User interaction is required because the victim must be induced to connect through the attacker\'s RD Gateway, such as via a supplied .rdp file.


7) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in rts_read_result() in libfreerdp/core/gateway/rts.c when parsing a truncated BIND_ACK result list sent by an RD Gateway over the RPC-over-HTTP transport. A remote attacker can send a specially crafted BIND_ACK fragment to cause a denial of service.

User interaction is required to induce the victim to connect through an attacker-controlled gateway, such as via a crafted .rdp file or link.


8) Improper Validation of Array Index (CVE-ID: N/A)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information, modify memory, and cause a denial of service.

The vulnerability exists due to improper validation of array index in X11 monitor selection in xf_detect_monitors when processing an attacker-supplied .rdp connection file. A remote attacker can trick the victim into opening a crafted file to disclose sensitive information, modify memory, and cause a denial of service.

No server connection is required because the issue is triggered during PreConnect before any RDP traffic, and user interaction is required to open the crafted .rdp file.


9) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the smartcard RDPDR device handling in DeviceServiceEntry() and devman teardown when worker thread creation fails after device registration. A local user can trigger worker creation failure and then perform normal channel teardown to cause a denial of service.

Exploitation requires smartcard redirection to be enabled.


10) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in ntlm_computeMicValue in winpr/libwinpr/sspi/NTLM/ntlm.c when processing an NTLM AUTHENTICATE message. A remote attacker can send a specially crafted NTLM AUTHENTICATE message to cause memory corruption.

Exploitation requires a server that has registered the SspiNtlmHashCallback API callback, and no shipped FreeRDP binary enables this path.


11) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of uninitialized heap memory in Save Session Info PDU writers in libfreerdp/core/info.c when serializing Save Session Info PDUs. A remote user can trigger the server or proxy to send a specially crafted Save Session Info PDU to disclose sensitive information.

The issue affects freerdp-proxy and third-party FreeRDP-based servers that originate or re-serialize this PDU, and repeated reconnects can yield fresh leaked heap samples.


12) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in general_ChromaV1ToYUV444 in the FreeRDP primitives library when processing a crafted RFX_AVC444_BITMAP_STREAM from a malicious server. A remote attacker can send a specially crafted bitmap stream to disclose sensitive information and cause a denial of service.

User interaction is required because the victim must connect to the malicious RDP server. The issue affects the server-to-client direction and is duplicated in the generic, NEON, and SSE implementations.


13) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in smartcard response decoders in libfreerdp/utils/smartcard_pack.c when processing smartcard device-I/O completion responses with oversized ATR lengths. A remote user can send a structurally valid smartcard response with an oversized ATR length to cause a denial of service.

The server must enable smartcard redirection and have an outstanding Status or GetStatusChange request.


14) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in rdp_write_multifragment_update_capability_set when processing client-supplied DesktopWidth and DesktopHeight values during GCC negotiation and Demand Active capability writing. A remote attacker can send specially crafted desktop dimension values to cause a denial of service.

In the verified TLS-only or standard RDP security configuration without NLA, the crash occurs before credential verification. Default-build configurations with verbose assertions enabled are affected.


15) Division by zero (CVE-ID: N/A)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to divide by zero in rdp_write_multifragment_update_capability_set when processing client-supplied DesktopWidth and DesktopHeight values during GCC negotiation and Demand Active capability writing. A remote attacker can send specially crafted desktop dimension values to cause a denial of service.

In the verified TLS-only or standard RDP security configuration without NLA, the crash occurs before credential verification. Default-build configurations with verbose assertions enabled are affected.


16) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in gdi_surface_bits when processing a surface bits command that claims to use NSCodec. A remote attacker can send a specially crafted RDP server message to cause a denial of service.

User interaction is required to connect to a malicious server, and the issue occurs when the client has not enabled NSCodec.


17) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in nego_send_negotiation_request when processing an oversized LB_LOAD_BALANCE_INFO routing token during connection negotiation. A remote attacker can send a crafted Server Redirection PDU to cause a denial of service.

The issue is reachable before any security protocol handshake completes, and user interaction is required to connect to a malicious server or a machine-in-the-middle server.


18) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in pool_decode_rect when processing AVC444 or AVC444v2 graphics updates with numRegionRects greater than work_object_count in threaded decode mode. A remote attacker can send a specially crafted RDP graphics metablock to cause a denial of service.

User interaction is required because the victim must connect to a malicious or compromised RDP server. The issue is reachable only in the threaded AVC444 client decode path when useThreads is enabled and the EXTGPU fast-path is not active.


19) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in urb_send_current_frame_number_result() in the urbdrc client channel when processing a crafted USB redirection message from an RDP server. A remote attacker can send a specially crafted 28-byte message to cause a denial of service.

User interaction is required to start an RDP connection with USB redirection enabled and a device actually redirected.


20) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in rdpdr_dump_packet in libfreerdp/utils/rdpdr_utils.c when processing a crafted RDPDR PAKID_CORE_CLIENT_NAME packet. A remote attacker can send a specially crafted packet with a large computerNameLen value to disclose sensitive information or cause a denial of service.

The issue is reachable before state-machine or length validation and requires TRACE-level logging to be enabled for the rdpdr logger.


21) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass the configured transport security policy and disclose sensitive information.

The vulnerability exists due to improper handling of exceptional conditions in rdp_server_accept_nego() and protocol selection logic when processing an RDP negotiation failure followed by continued connection handling. A remote attacker can send an incompatible negotiation request and then continue the same connection to enter unintended RDSTLS processing to bypass the configured transport security policy and disclose sensitive information.

The issue is pre-authentication and can expose RDSTLS capabilities and related server-side parsers before the configured authentication mechanism runs.


22) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in ChannelPduTracker_poll() in libfreerdp/utils/channel_pdu_tracker.c when processing oversized SHOW_PROTOCOL static virtual-channel messages. A remote user can send a specially crafted channel message to execute arbitrary code.

On assertion-enabled builds, the same input aborts the process instead. The out-of-bounds write requires channel_pdu_tracker.c to be built with NDEBUG and without WITH_VERBOSE_WINPR_ASSERT.


23) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service and potentially disclose sensitive information or modify data.

The vulnerability exists due to use-after-free in the server-side DRDYNVC parser when processing concurrent channel close and DRDYNVC data for the same dynamic virtual channel. A remote user can race channel-closing traffic with overlapping DRDYNVC data to cause a denial of service and potentially disclose sensitive information or modify data.

The server must enable a dynamic virtual channel whose worker can close it while the socket thread parses client data. The validated trigger uses AUDIN, and exploitation requires winning a race condition during channel close and parsing.


24) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the RDPGFX ResetGraphics serializer when handling ResetGraphics PDUs on an active RDPGFX dynamic virtual channel. A remote user can trigger a ResetGraphics operation to disclose sensitive information.

The issue can disclose between 20 and 300 bytes of stale heap memory, including heap pointers and GLib function pointers. Reaching the vulnerable path requires completion of the RDPGFX capability exchange.


Remediation

Install update from vendor's website.

References