Return of Wrong Status Code in FreeRDP - #VU164458
Published: November 10, 2026
Vulnerability identifier: #VU164458
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-393
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially disrupt client operation by causing decoding to continue after internal parsing failures.
The vulnerability exists due to incorrect success status reporting in FreeRDP's Progressive decompressor when internal parsing failures follow error paths that do not set an error code. A remote attacker can send malformed Progressive graphics data from a malicious RDP server to cause the connected client to continue processing data after a decoding failure, potentially aggravating corrupted decoder state and destabilizing the client.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.33.0