SB2026101948 - Multiple vulnerabilities in FreeRDP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101948

SB2026101948 - Multiple vulnerabilities in FreeRDP

Published: October 19, 2026 Updated: October 19, 2026

Security Bulletin ID SB2026101948
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 44% Low 56%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a connecting FreeRDP client process.

The vulnerability exists due to a reachable assertion in the FreeRDP RemoteFX decoder's rfx_process_message function when processing region rectangle coordinates. A remote attacker can induce a user to connect to a malicious RDP server and negotiate RemoteFX, then send a crafted region rectangle with x = 65535 and a SurfaceBits destination with left = 1 to trigger the assertion that their sum fits in a 16-bit coordinate and abort the client process.

The demonstrated crash requires a client built with WITH_VERBOSE_WINPR_ASSERT=ON.


2) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service if image re-encoding triggers a JPEG compression error.

The vulnerability exists due to missing library error handling in winpr_convert_to_jpeg() when re-encoding image data as JPEG. A remote attacker can supply image data for clipboard conversion that, if it triggers a libjpeg compression error, invokes the default error_exit handler and terminates the client process.


3) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the FreeRDP client process.

The vulnerability exists due to missing library error handling in winpr_convert_from_jpeg() when decoding malformed JPEG clipboard content supplied by an RDP peer. A remote attacker can offer a truncated JPEG clipboard payload that is processed during clipboard conversion to invoke libjpeg's default error_exit handler, which calls exit(EXIT_FAILURE) and terminates the client instead of returning a decoding error.


4) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by aborting the FreeRDP client process.

The vulnerability exists due to missing library error handling in winpr_read_png_from_buffer() when decoding malformed PNG clipboard content supplied by an RDP peer. A remote attacker can offer a malformed PNG clipboard payload that is processed during clipboard conversion to trigger libpng's error handler without an initialized jump target, causing the client process to abort.


5) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service by terminating the process decoding a malformed JPEG image.

The vulnerability exists due to improper handling of exceptional conditions in winpr_convert_from_jpeg() in winpr/libwinpr/utils/image.c when decoding malformed JPEG content during clipboard format conversion. A local user can supply malformed or truncated JPEG data through the local clipboard to trigger libjpeg's default error_exit handler, which calls exit() and terminates the process instead of returning a decoding failure.

The vulnerable decoder requires a build with WINPR_UTILS_IMAGE_JPEG enabled.


6) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service by aborting the process decoding a malformed PNG image.

The vulnerability exists due to improper handling of exceptional conditions in winpr_read_png_from_buffer() in winpr/libwinpr/utils/image.c when decoding malformed PNG content during clipboard format conversion. A local user can supply local clipboard PNG data containing truncation, a bad CRC, or corrupt IDAT data to trigger png_error(); because no setjmp handler is installed, libpng's default error handler calls abort() and terminates the process.

The vulnerable decoder requires a build with WINPR_UTILS_IMAGE_PNG enabled.


7) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to expose potentially sensitive heap memory in PNG data delivered to the local clipboard.

The vulnerability exists due to an out-of-bounds read in save_png_to_buffer() in winpr/libwinpr/utils/image.c when converting 16 bpp DIB images to PNG. A remote attacker can supply a server-controlled 16 bpp BI_BITFIELDS DIB through clipboard redirection and trigger conversion when a local application requests image/png, causing libpng to read three bytes per pixel from rows containing only two bytes per pixel and include adjacent heap bytes in the resulting image.

The vulnerable conversion requires a build with WINPR_UTILS_IMAGE_PNG enabled.


8) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a FreeRDP client process.

The vulnerability exists due to a reachable assertion in the FreeRDP RemoteFX differential decoder when processing crafted RemoteFX tile data. A remote attacker can entice a victim to connect to a malicious RDP server and send a tile containing two adjacent LL3 coefficients of 20,000 each, whose sum of 40,000 fails a signed 16-bit range assertion, to abort the client process.

Exploitation requires a client build with verbose WinPR assertions enabled (WITH_VERBOSE_WINPR_ASSERT=ON) and a server that negotiates the classic RemoteFX surface-bits path.


9) Type conversion (CVE-ID: N/A)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a FreeRDP client process.

The vulnerability exists due to an incorrect type conversion in the rfx_rlgr_decode function in libfreerdp/codec/rfx_rlgr.c when decoding server-supplied tile data with RemoteFX surface decoding enabled. A remote attacker can trick a victim into connecting to a malicious RDP server and send a crafted RemoteFX tileset containing RLGR code 32767 to trigger an assertion during the conversion of code + 1 to int16_t and terminate the client process.

The process-terminating assertion depends on the build configuration and requires WITH_VERBOSE_WINPR_ASSERT to be enabled.


10) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the FreeRDP client process.

The vulnerability exists due to a reachable assertion in the rdpdr_dump_packet function when processing a malformed RDPDR device-list announcement with an unchecked device-data length. A remote attacker can send an announcement with DeviceDataLength exceeding the remaining packet data from a malicious server selected by the victim to trigger a fatal Stream_Seek assertion and abort the client process.

The demonstrated abort requires device redirection to be enabled, RDPDR TRACE logging to be active, and WinPR assertions to be enabled in the client build.


11) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass server-identity verification and intercept or modify RDP session contents.

The vulnerability exists due to improper certificate validation in FreeRDP's TLS certificate identity checks when matching an IP-literal connection target against Common Name or DNS Subject Alternative Name strings instead of iPAddress Subject Alternative Names. A remote attacker can intercept or redirect an RDP connection and present a certificate that chains to a client-trusted CA, with a Common Name or DNS Subject Alternative Name equal to the target IP address but no corresponding iPAddress Subject Alternative Name, to bypass server-identity verification and read or manipulate session contents without a certificate warning.


12) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass server-identity verification and intercept or modify RDP session contents.

The vulnerability exists due to improper certificate validation in FreeRDP's tls_verify_certificate() when checking a certificate's Common Name despite the presence of non-matching DNS Subject Alternative Names. A remote attacker can intercept or redirect an RDP connection and present a certificate that chains to a client-trusted CA, with a Common Name matching the target hostname but only non-matching DNS Subject Alternative Names, to bypass server-identity verification and read or manipulate session contents without a certificate warning.


13) Missing Release of Resource after Effective Lifetime (CVE-ID: N/A)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting the FreeRDP client process's file descriptors.

The vulnerability exists due to missing release of file descriptors in the parallel_process_irp_create function when handling repeated IRP_MJ_CREATE requests after a user connects to a hostile RDP server. A remote attacker can repeatedly send these requests for the announced parallel device, causing each successful open to replace parallel->file without closing the previous descriptor, to exhaust the process descriptor table and prevent further descriptor allocation.

Exploitation requires explicit client-side parallel-device redirection to a local path that can be opened.


14) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the FreeRDP client process.

The vulnerability exists due to a reachable assertion in FreeRDP's ARM gateway response handling when processing an HTTP 200 JSON response with a missing or non-string redirectedServerCert field. A remote attacker can return such a response from a gateway selected by the victim to pass a null buffer to the target-certificate parser, trigger an assertion, and terminate the client process.

Exploitation requires a client built with WITH_AAD=ON; the default AAD-disabled build does not compile the ARM gateway route.


15) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating an assertion-enabled FreeRDP client.

The vulnerability exists due to a reachable assertion in update_process_glyph_fragments when processing a GLYPH_INDEX background width that cannot be represented as an INT16. A remote attacker can trick a victim into connecting to a malicious RDP server, negotiate a desktop width of at least 32768 pixels, and send a GLYPH_INDEX order with bkLeft=-32768 and bkRight=32767 to trigger WINPR_ASSERTING_INT_CAST(INT16, bkWidth) and terminate the client.


16) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by triggering an assertion that aborts an X11 FreeRDP client.

The vulnerability exists due to insufficient validation of server-supplied scaled-output geometry in FreeRDP's RDPGFX and X11 graphics handling when processing surface mappings and subsequent display updates. A remote attacker can induce a victim to connect to a controlled RDP server, create a graphics surface, and send a MAPSURFACETOSCALEDOUTPUT PDU with oversized target dimensions or output coordinates to trigger a checked-cast or scaling assertion under the affected rendering conditions.


17) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a FreeRDP client's RDP session.

The vulnerability exists due to a reachable assertion in FreeRDP's RDPGFX ALPHA processing when handling a WIRETOSURFACE_2 command with zero surface-command dimensions. A remote attacker can induce a client with the graphics pipeline enabled to connect to a malicious RDP server, create a valid graphics surface, and send an ALPHA WIRETOSURFACE_2 command containing the four-byte bitmap payload 4c 41 00 00 to trigger the WINPR_ASSERT(size > 0) assertion in Stream_CheckAndLogRequiredLengthEx and abort the client.

The observed crash was in a verbose-assert build; termination without that assertion was not verified.


18) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by stopping the drive worker and causing subsequent requests to accumulate in memory.

The vulnerability exists due to improper error handling and allocation of resources without limits in FreeRDP's drive redirection worker when processing malformed server requests. A remote attacker can entice a victim to connect to a malicious RDP server, send a DEVICE_IOREQUEST with a valid 20-byte IRP header specifying IRP_MJ_CREATE but no CREATE body, and then send further requests to terminate the worker silently and accumulate queued requests without a consumer, causing session-scoped availability loss and potentially exhausting memory.


Remediation

Install update from vendor's website.

References