SB20261110330 - Multiple vulnerabilities in FreeRDP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110330

SB20261110330 - Multiple vulnerabilities in FreeRDP

Published: November 10, 2026

Security Bulletin ID SB20261110330
CSH Severity
High
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 13% Medium 60% Low 27%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Race condition (CVE-ID: N/A)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to exhaust client memory and cause a denial of service.

The vulnerability exists due to a reference-count race in FreeRDP's asynchronous RDPDR IRP processing when worker threads concurrently release the same input wStream using non-atomic decrements. A remote attacker can operate a malicious RDP server and repeatedly send IRPs through asynchronous redirected-device paths, including smartcard redirection, to accumulate streams and backing buffers that remain allocated until connection teardown.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger reads beyond a heap allocation in the FreeRDP client.

The vulnerability exists due to an out-of-bounds read in the smartcard channel when an odd-length mszGroups buffer is consumed without a WCHAR-aligned NUL terminator. A remote attacker can complete the RDP handshake with a client using /smartcard and send an SCARD_IOCTL_LISTREADERSW request with cBytes=1 and a non-NULL mszGroups containing 'E' to trigger the heap overread.


3) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory and cause a denial of service in applications using FreeRDP's H.264 codec.

The vulnerability exists due to a heap-based buffer overflow in FreeRDP's H.264 buffer management when h264_context_reset() updates dimensions before yuv_ensure_buffer() checks whether reallocation is necessary. A remote attacker can request a surface height increase without changing its width on servers supporting client-requested resizing, causing subsequent frame conversion to overwrite undersized YUV planes and corrupt adjacent heap memory.


4) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to expose client heap contents on screen or cause a denial of service by crashing FreeRDP.

The vulnerability exists due to use-after-free in FreeRDP brush handling for PatBlt, Mem3Blt, and PolygonCB when persistent drawing orders retain stale cache pointers and pixel depths. A remote attacker can send crafted CACHE_BRUSH and PATBLT orders from a server the victim connects to, replacing a cached brush before reusing its pointer or supplying an 8-byte inline brush with stale 24-bit depth, to trigger freed-memory or out-of-bounds reads.


5) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing the FreeRDP proxy process and interrupting all sessions it hosts.

The vulnerability exists due to a null pointer dereference in pf_server_refresh_rect and pf_server_suppress_output when processing pre-activation data without checking backend context availability or connection state. A remote attacker can complete channel joining, security negotiation and licensing, then send a REFRESH_RECT or SUPPRESS_OUTPUT data PDU before Confirm Active to crash the proxy.


6) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt client process memory and cause a denial of service.

The vulnerability exists due to integer overflow in FreeRDP client drawing-order bounds accumulation and GDI geometry calculations when processing server-supplied drawing orders, allowing invalid geometry to bypass clipping. A remote attacker can operate an RDP server that completes the handshake and sends repeated ORDER_BOUNDS updates followed by a crafted OPAQUE_RECT order to write beyond the heap-allocated drawing bitmap.


7) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject keyboard and mouse input into the host user's interactive X11 session without authentication.

The vulnerability exists due to missing authentication checks in FreeRDP's fastpath_recv_input_event_* handlers in libfreerdp/core/fastpath.c when dispatching input before the session reaches CONNECTION_STATE_ACTIVE. A remote attacker can negotiate TLS-only RDP, withhold Confirm Active, and send crafted Fast-Path input PDUs to manipulate the host user's X11 session through XTEST.


8) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by aborting freerdp-shadow-cli and terminating all sessions served by that process.

The vulnerability exists due to incorrect stream-position tracking in FreeRDP's remdesk server channel read loop when handling messages exceeding its 4096-byte buffer with shorter declared PDU lengths. A remote user can send a 4100-byte remdesk message containing only zero bytes to trigger a reachable assertion that aborts the server in default builds.


9) Release of invalid pointer or reference (CVE-ID: N/A)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service in a FreeRDP client.

The vulnerability exists due to an invalid pointer free in the RD Gateway transport when chunked decoder state overwrites a websocket context pointer stored in the same union. A remote attacker can supply crafted chunk sizes through a malicious RD Gateway data channel using Transfer-Encoding: chunked to trigger an invalid dereference and free during connection teardown, potentially crashing the client.


10) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger invalid server certificate signatures that can cause validating clients to reject connections.

The vulnerability exists due to use-after-free in FreeRDP's cert_write_server_certificate_v1() when stream reallocation invalidates a saved pointer before signature hashing. A remote attacker can negotiate Standard RDP Security with at least four static channels against a server using a 3072-bit key, or with any channel count against a server using a 4096-bit key, to trigger freed-memory reads and invalid certificate signatures.


11) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose client-process heap memory through generated PNG images.

The vulnerability exists due to an out-of-bounds read in FreeRDP's WinPR save_png_to_buffer() function when converting 9–16 bpp images to PNG because the selected RGB format requires more bytes per pixel than the row buffer contains. A remote attacker can supply crafted CF_DIB or CF_DIBV5 clipboard data from a malicious RDP server and have a local application request image/png to expose adjacent heap bytes in the resulting image.


12) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain a configured reusable client password intended to be withheld by Remote Credential Guard.

The vulnerability exists due to insufficient credential protection in FreeRDP's Client Info writer when handling Remote Credential Guard connections, with separate negotiation validation weaknesses permitting a downgrade to the same disclosure path. A remote attacker can entice a victim with a configured /p password to connect to a controlled server and receive that password after Kerberos/CredSSP or through selection of an unoffered classic RDP protocol.


13) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through unbounded memory consumption and quadratic CPU usage.

The vulnerability exists due to uncontrolled resource consumption in FreeRDP's progressive_decompress() function when processing successive Progressive graphics commands without a change in frame identifier. A remote attacker can operate a malicious RDP server and repeatedly send RDPGFX_CAPROGRESSIVE WireToSurface2 commands with a constant frameId, or omit RDPGFX_START_FRAME, to accumulate tile updates and allocations until the connected client becomes unresponsive or exhausts memory.


14) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory and crash a connected FreeRDP client.

The vulnerability exists due to a heap-based buffer overflow in FreeRDP's Progressive codec when tile-cache growth fails after the recorded capacity has already been increased. A remote attacker can operate a malicious RDP server and send Progressive graphics commands that exhaust available memory to leave the capacity check inconsistent with the allocated buffer and trigger an out-of-bounds write that corrupts memory and crashes the client.


15) Return of Wrong Status Code (CVE-ID: N/A)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially disrupt client operation by causing decoding to continue after internal parsing failures.

The vulnerability exists due to incorrect success status reporting in FreeRDP's Progressive decompressor when internal parsing failures follow error paths that do not set an error code. A remote attacker can send malformed Progressive graphics data from a malicious RDP server to cause the connected client to continue processing data after a decoding failure, potentially aggravating corrupted decoder state and destabilizing the client.


Remediation

Install update from vendor's website.

References