Vulnerability-Lookup

RHSA-2026:98598

Vulnerability from csaf_redhat - Published: 2026-11-11 13:48 - Updated: 2026-11-13 03:54

Summary

Red Hat Security Advisory: freerdp security, bug fix, and enhancement update

Severity

Critical

Notes

Topic: An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) * FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL (CVE-2026-91948) * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel (CVE-2026-91951) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) * FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing (CVE-2026-91945) * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) * freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676) * freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838) * freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830) * freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) * freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833) * freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839) * freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378) * freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379) * freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381) * freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382) * freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) * freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045) * freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads (CVE-2026-121386) * freerdp: freerdp: Denial of Service via zero-width graphics reset (CVE-2026-121402) * freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages (CVE-2026-121404) * freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels (CVE-2026-121388) * freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder (CVE-2026-121394) Bug Fix(es) and Enhancement(s): * Rebase FreeRDP to 3.32.2 or newer [rhel-10.3.z] (JIRA:RHEL-277443) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-85089

A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap memory that may contain cleartext credentials from previous sessions.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-908 - Use of Uninitialized Resource

Affected products

Fixed 65 products

Product	Version	Remediation
Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-debugsource-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-devel-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-libs-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:freerdp-server-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-debuginfo-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-10.3.Z:libwinpr-devel-2:3.32.2-1.el10_3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-91945

A flaw was found in FreeRDP. Authenticated RDP clients can exploit an out-of-bounds read vulnerability in smartcard response decoders. This occurs because the decoders fail to validate the length of Answer to Reset (ATR) fields against fixed inline arrays. By sending oversized ATR lengths, an attacker can trigger reads past memory objects, leading to process termination and a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91946

A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server's ResetGraphics Protocol Data Unit (PDU) serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of sensitive data, including live pointers and GLib function addresses, which could defeat Address Space Layout Randomization (ASLR) and reveal the GLib module's base address.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91947

A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data parsing, leading to memory corruption. This could potentially result in arbitrary code execution or a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-91948

A flaw was found in FreeRDP. An authenticated client can send specially crafted, oversized messages to the server when the CHANNEL_OPTION_SHOW_PROTOCOL feature is active. This can cause a buffer underflow, leading to corruption of memory and potentially allowing an attacker to execute malicious code on the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-124 - Buffer Underwrite

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-91949

A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security (RDSTLS) connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can establish RDSTLS connections, thereby circumventing pre-authentication transport restrictions.

9.3 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Critical

CVE-2026-91950

A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdr_dump_packet function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causing the client to read memory beyond the intended buffer. This can result in client crashes, leading to a denial of service, or the disclosure of sensitive heap memory information in logs. Exploitation requires the client to have WLOG_TRACE-level logging enabled.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-91951

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send a specially crafted USB redirection message to the urbdrc client channel. This can trigger an out-of-bounds write, leading to a denial of service (DoS) for the client when verbose asserts are enabled.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91953

A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91954

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the `gdi_surface_bits` function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91956

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the URBDRC (USB device redirection) channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to a client crash and a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91959

A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91960

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the `Stream_EnsureRemainingCapacity` function, leading to an integer wraparound and a double free vulnerability. Successful exploitation results in a denial of service, causing the FreeRDP client to crash during connection.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the `nego_send_negotiation_request` function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled `LoadBalanceInfo` field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-109242

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE-908 - Use of Uninitialized Resource

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-109676

A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to cause memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS) through an application crash.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-110830

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-110833

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-110837

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-110838

A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potentially performing unauthorized actions on the host system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-306 - Missing Authentication for Critical Functionality

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-110839

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-111378

A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-111379

A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer to be allocated, leading to a heap-based buffer overflow during data read operations.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-111381

A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-111382

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-111880

A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager (NTLM) authentication path can result in a Denial of Service (DoS). When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check (MIC) offset. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted authentication message, corrupting heap memory and causing the server to crash.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-114045

A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121386

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121388

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121394

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121402

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121404

A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121950

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a denial of service (DoS) or memory corruption on a connecting client. This issue occurs because FreeRDP does not properly validate graphical surface dimensions, resulting in an integer overflow during memory allocation calculations. By sending a specially crafted surface creation message, a rogue server can trigger excessive memory consumption or a heap-based buffer overflow, causing the client application to crash.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121951

A flaw was found in FreeRDP. In server-side input parsing, the application skips the body of an unknown input event without verifying that the data remains within the declared packet length. A remote attacker with an active session can send a crafted, truncated input event, triggering an internal assertion failure that terminates the server process and causes a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121952

A flaw was found in FreeRDP. An out-of-bounds write vulnerability exists in freerdp-proxy when processing Bitmap Cache v2 capability sets. The proxy accepts a client-declared numCellCaches value below five and later indexes the bitmap cache cell array at fixed positions 0 through 4. A client that connects to the proxy and completes capability exchange can cause heap corruption, disclosure of adjacent heap contents to the backend server, or a crash of the proxy process.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121953

A flaw was found in FreeRDP. A use-after-free vulnerability exists in the client's Remote Desktop Protocol Graphics (RDPGFX) dynamic virtual channel handling. A malicious RDP server can open a second dynamic virtual channel that reuses an already registered channel name with a different ChannelId, overwriting the listener's single callback slot. When that second channel is closed, the callback is freed without clearing the slot. A subsequent PDU on the original channel then dereferences freed memory, which can crash the client or potentially lead to arbitrary code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121954

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) and heap memory corruption on the connecting client. This issue occurs in the planar graphics codec because new display dimensions are applied before memory buffer reallocation succeeds. When reallocation fails, the context is not rolled back, allowing subsequent planar drawing commands to write beyond the allocated buffer boundaries and crash the client.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121955

A flaw was found in FreeRDP. A use-after-free vulnerability exists in the smartcard emulation feature where a smartcard context is released before its background worker thread is properly terminated. A malicious server can exploit this by sending a crafted sequence of smartcard I/O Request Packets (IRPs) to a client with smartcard redirection enabled. Successful exploitation can corrupt memory or cause the client application to crash, leading to a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121956

A flaw was found in FreeRDP. A double-free memory vulnerability in the Kerberos authentication component allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending a specially crafted Network Level Authentication (NLA) request, an attacker can corrupt server memory and cause the application process to crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-415 - Double Free

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121957

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a race condition in the client by concurrently transmitting graphics reset commands alongside compressed bitmap data. This flaw leads to a use-after-free condition or out-of-bounds memory access on shared graphics decoding buffers. Consequently, an attacker can corrupt client memory, potentially causing the client application to crash resulting in a Denial of Service (DoS) or exposing sensitive memory contents.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121958

A flaw was found in FreeRDP. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) or potentially execute arbitrary code on the client system. An attacker operating a malicious Remote Desktop Protocol (RDP) server, or acting in a man-in-the-middle position, can exploit this issue by sending specially crafted graphics pipeline commands. This occurs due to improper surface key truncation, causing an internal table to become inconsistent and triggering a heap-based buffer overflow when data is written past allocated memory boundaries.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121959

A flaw was found in FreeRDP. A malicious Remote Desktop (RD) Gateway or network attacker can cause a Denial of Service (DoS) by sending a truncated WebSocket data frame followed by a Transport Layer Security (TLS) connection shutdown. Due to improper handling of the incomplete payload when the connection closes, the client enters an infinite loop, consuming excessive Central Processing Unit (CPU) resources until the application is terminated.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121960

A flaw was found in FreeRDP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted Credential Security Support Provider (CredSSP) request that omits negotiation tokens. When processing this malformed request with Network Level Authentication (NLA) enabled, the server triggers an internal assertion failure that abruptly terminates the server process and drops active client sessions.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121961

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol (RDP) server can trigger a race condition by repeatedly requesting the creation of an already active dynamic virtual channel while client data is concurrently processed. This issue leads to a use-after-free condition, allowing the server to crash the proxy process and result in a Denial of Service (DoS).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121962

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) or memory corruption by sending fragmented responses during Early User Authorization (EUA) authentication. Because FreeRDP fails to properly track remaining buffer space across partial network reads, incoming data advances past the allocated memory boundaries. An attacker who successfully exploits this issue triggers an out-of-bounds memory write, crashing the client application.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

CVE-2026-121963

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the client application. By sending audio data packets over a dynamic virtual channel and immediately closing the connection, the server triggers a use-after-free condition where the client's audio playback thread accesses already released memory.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Moderate

CVE-2026-121964

A flaw was found in FreeRDP. A compromised or malicious Remote Desktop (RD) Gateway server can send specially crafted Remote Procedure Call (RPC) network messages to a connecting client. Because the client verifies total buffer capacity instead of remaining buffer space before writing incoming data, client heap memory can be overwritten. An attacker can exploit this flaw to potentially execute arbitrary code or crash the client application, resulting in a Denial of Service (DoS).

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 65 products, the same list as for CVE-2026-85089

Threats

Impact Important

References

331 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:98598	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2527811	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533904	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533906	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533911	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533913	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533925	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533927	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533928	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533930	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533942	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533951	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533954	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533957	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533959	external
https://bugzilla.redhat.com/show_bug.cgi?id=2533965	external
https://bugzilla.redhat.com/show_bug.cgi?id=2549790	external
https://bugzilla.redhat.com/show_bug.cgi?id=2550539	external
https://bugzilla.redhat.com/show_bug.cgi?id=2552961	external
https://bugzilla.redhat.com/show_bug.cgi?id=2552970	external
https://bugzilla.redhat.com/show_bug.cgi?id=2552978	external
https://bugzilla.redhat.com/show_bug.cgi?id=2552988	external
https://bugzilla.redhat.com/show_bug.cgi?id=2552996	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553907	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553911	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553917	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553920	external
https://bugzilla.redhat.com/show_bug.cgi?id=2554625	external
https://bugzilla.redhat.com/show_bug.cgi?id=2557974	external
https://bugzilla.redhat.com/show_bug.cgi?id=2565870	external
https://bugzilla.redhat.com/show_bug.cgi?id=2565949	external
https://bugzilla.redhat.com/show_bug.cgi?id=2565951	external
https://bugzilla.redhat.com/show_bug.cgi?id=2565959	external
https://bugzilla.redhat.com/show_bug.cgi?id=2565962	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-85089	self
https://bugzilla.redhat.com/show_bug.cgi?id=2527811	external
https://www.cve.org/CVERecord?id=CVE-2026-85089	external
https://nvd.nist.gov/vuln/detail/CVE-2026-85089	external
https://github.com/FreeRDP/FreeRDP	external
https://github.com/FreeRDP/FreeRDP/blob/3.30.0/li…	external
https://github.com/FreeRDP/FreeRDP/commit/056cede…	external
https://github.com/FreeRDP/FreeRDP/commit/483c938…	external
https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91945	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533965	external
https://www.cve.org/CVERecord?id=CVE-2026-91945	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91945	external
https://github.com/FreeRDP/FreeRDP/commit/9626564…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91946	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533913	external
https://www.cve.org/CVERecord?id=CVE-2026-91946	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91946	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91947	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533942	external
https://www.cve.org/CVERecord?id=CVE-2026-91947	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91947	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-serv…	external
https://access.redhat.com/security/cve/CVE-2026-91948	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533904	external
https://www.cve.org/CVERecord?id=CVE-2026-91948	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91948	external
https://github.com/FreeRDP/FreeRDP/commit/40d9202…	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91949	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533925	external
https://www.cve.org/CVERecord?id=CVE-2026-91949	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91949	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.0.…	external
https://access.redhat.com/security/cve/CVE-2026-91950	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533954	external
https://www.cve.org/CVERecord?id=CVE-2026-91950	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91950	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91951	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533928	external
https://www.cve.org/CVERecord?id=CVE-2026-91951	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91951	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.14…	external
https://access.redhat.com/security/cve/CVE-2026-91953	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533959	external
https://www.cve.org/CVERecord?id=CVE-2026-91953	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91953	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91954	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533906	external
https://www.cve.org/CVERecord?id=CVE-2026-91954	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91954	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533927	external
https://www.cve.org/CVERecord?id=CVE-2026-91956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91956	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91959	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533951	external
https://www.cve.org/CVERecord?id=CVE-2026-91959	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91959	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91960	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533957	external
https://www.cve.org/CVERecord?id=CVE-2026-91960	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91960	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-91963	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533930	external
https://www.cve.org/CVERecord?id=CVE-2026-91963	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91963	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external
https://access.redhat.com/security/cve/CVE-2026-91964	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533911	external
https://www.cve.org/CVERecord?id=CVE-2026-91964	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91964	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external
https://access.redhat.com/security/cve/CVE-2026-109242	self
https://bugzilla.redhat.com/show_bug.cgi?id=2549790	external
https://www.cve.org/CVERecord?id=CVE-2026-109242	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109242	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-109676	self
https://bugzilla.redhat.com/show_bug.cgi?id=2550539	external
https://www.cve.org/CVERecord?id=CVE-2026-109676	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109676	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.0.…	external
https://access.redhat.com/security/cve/CVE-2026-110830	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552970	external
https://www.cve.org/CVERecord?id=CVE-2026-110830	external
https://nvd.nist.gov/vuln/detail/CVE-2026-110830	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-110833	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552988	external
https://www.cve.org/CVERecord?id=CVE-2026-110833	external
https://nvd.nist.gov/vuln/detail/CVE-2026-110833	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-110837	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552978	external
https://www.cve.org/CVERecord?id=CVE-2026-110837	external
https://nvd.nist.gov/vuln/detail/CVE-2026-110837	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external
https://access.redhat.com/security/cve/CVE-2026-110838	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552961	external
https://www.cve.org/CVERecord?id=CVE-2026-110838	external
https://nvd.nist.gov/vuln/detail/CVE-2026-110838	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-shad…	external
https://access.redhat.com/security/cve/CVE-2026-110839	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552996	external
https://www.cve.org/CVERecord?id=CVE-2026-110839	external
https://nvd.nist.gov/vuln/detail/CVE-2026-110839	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.3.…	external
https://access.redhat.com/security/cve/CVE-2026-111378	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553907	external
https://www.cve.org/CVERecord?id=CVE-2026-111378	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111378	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.0.…	external
https://access.redhat.com/security/cve/CVE-2026-111379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553911	external
https://www.cve.org/CVERecord?id=CVE-2026-111379	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111379	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-111381	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553917	external
https://www.cve.org/CVERecord?id=CVE-2026-111381	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111381	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-111382	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553920	external
https://www.cve.org/CVERecord?id=CVE-2026-111382	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111382	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-111880	self
https://bugzilla.redhat.com/show_bug.cgi?id=2554625	external
https://www.cve.org/CVERecord?id=CVE-2026-111880	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111880	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-2.0.…	external
https://access.redhat.com/security/cve/CVE-2026-114045	self
https://bugzilla.redhat.com/show_bug.cgi?id=2557974	external
https://www.cve.org/CVERecord?id=CVE-2026-114045	external
https://nvd.nist.gov/vuln/detail/CVE-2026-114045	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121386	self
https://bugzilla.redhat.com/show_bug.cgi?id=2565870	external
https://www.cve.org/CVERecord?id=CVE-2026-121386	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121386	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121388	self
https://bugzilla.redhat.com/show_bug.cgi?id=2565959	external
https://www.cve.org/CVERecord?id=CVE-2026-121388	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121388	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.0.…	external
https://access.redhat.com/security/cve/CVE-2026-121394	self
https://bugzilla.redhat.com/show_bug.cgi?id=2565962	external
https://www.cve.org/CVERecord?id=CVE-2026-121394	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121394	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121402	self
https://bugzilla.redhat.com/show_bug.cgi?id=2565949	external
https://www.cve.org/CVERecord?id=CVE-2026-121402	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121402	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121404	self
https://bugzilla.redhat.com/show_bug.cgi?id=2565951	external
https://www.cve.org/CVERecord?id=CVE-2026-121404	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121404	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121950	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567633	external
https://www.cve.org/CVERecord?id=CVE-2026-121950	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121950	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121951	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567548	external
https://www.cve.org/CVERecord?id=CVE-2026-121951	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121951	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-3.0.…	external
https://access.redhat.com/security/cve/CVE-2026-121952	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567902	external
https://www.cve.org/CVERecord?id=CVE-2026-121952	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121952	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121953	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567941	external
https://www.cve.org/CVERecord?id=CVE-2026-121953	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121953	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121954	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567613	external
https://www.cve.org/CVERecord?id=CVE-2026-121954	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121954	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121955	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567569	external
https://www.cve.org/CVERecord?id=CVE-2026-121955	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121955	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567939	external
https://www.cve.org/CVERecord?id=CVE-2026-121956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121956	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121957	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567521	external
https://www.cve.org/CVERecord?id=CVE-2026-121957	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121957	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121958	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567629	external
https://www.cve.org/CVERecord?id=CVE-2026-121958	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121958	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-thro…	external
https://access.redhat.com/security/cve/CVE-2026-121959	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567740	external
https://www.cve.org/CVERecord?id=CVE-2026-121959	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121959	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121960	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567558	external
https://www.cve.org/CVERecord?id=CVE-2026-121960	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121960	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121961	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567461	external
https://www.cve.org/CVERecord?id=CVE-2026-121961	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121961	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121962	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567559	external
https://www.cve.org/CVERecord?id=CVE-2026-121962	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121962	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121963	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567464	external
https://www.cve.org/CVERecord?id=CVE-2026-121963	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121963	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external
https://access.redhat.com/security/cve/CVE-2026-121964	self
https://bugzilla.redhat.com/show_bug.cgi?id=2567871	external
https://www.cve.org/CVERecord?id=CVE-2026-121964	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121964	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://www.vulncheck.com/advisories/freerdp-befo…	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2026-109242 (GCVE-0-2026-109242)

Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-15 02:28

Title

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade

Summary

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 02:27 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.0.0 (semver) Affected: 3.6.0 , < 3.32.0 (semver) Unaffected: 3.0.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp:::::::: cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-28 00:00

Credits

router0mail

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109242",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T02:27:47.243992Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T02:28:09.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "router0mail"
        }
      ],
      "datePublic": "2026-09-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-\u003ecurrent buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T16:04:18.336Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4mpr-hmqx-83q8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.0.0-and-3.6.0-before-3.32.0-uninitialized-heap-disclosure-via-progressive-codec-tile-upgrade"
        }
      ],
      "title": "FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109242",
    "datePublished": "2026-10-12T16:04:18.336Z",
    "dateReserved": "2026-10-12T14:07:56.520Z",
    "dateUpdated": "2026-10-15T02:28:09.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109676 (GCVE-0-2026-109676)

Vulnerability from cvelistv5 – Published: 2026-10-13 13:27 – Updated: 2026-10-14 14:00

Title

FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

Summary

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 13:59 UTC

CWE

CWE-416 - Use After Free

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 3.0.0-beta1 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-29 00:00

Credits

alexdowad x30n

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T13:59:11.733165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T14:00:09.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.0.0-beta1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.0.0-beta1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "alexdowad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "x30n"
        }
      ],
      "datePublic": "2026-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T13:27:05.624Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-369h-7h2p-4685)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect"
        }
      ],
      "title": "FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109676",
    "datePublished": "2026-10-13T13:27:05.624Z",
    "dateReserved": "2026-10-12T21:08:17.598Z",
    "dateUpdated": "2026-10-14T14:00:09.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110830 (GCVE-0-2026-110830)

Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 18:12

Title

FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE

Summary

FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:12 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0-rc0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-30 00:00

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110830",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:12:07.527321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:12:12.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "2.0.0-rc0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "2.0.0-rc0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:05.434Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mqxv-c882-m8w9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-denial-of-service-via-serial-irp-mj-create"
        }
      ],
      "title": "FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110830",
    "datePublished": "2026-10-14T22:52:05.434Z",
    "dateReserved": "2026-10-14T22:11:15.574Z",
    "dateUpdated": "2026-10-15T18:12:12.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110833 (GCVE-0-2026-110833)

Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-16 17:15

Title

FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

Summary

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 16:31 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 3.0.0-beta1 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-29 00:00

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110833",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:31:12.489459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:15:19.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.0.0-beta1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.0.0-beta1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        }
      ],
      "datePublic": "2026-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:08.294Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m7g5-gw57-cwcr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-unbounded-memory-retention-via-rdpdr-proxy"
        }
      ],
      "title": "FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110833",
    "datePublished": "2026-10-14T22:52:08.294Z",
    "dateReserved": "2026-10-14T22:11:15.575Z",
    "dateUpdated": "2026-10-16T17:15:19.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110837 (GCVE-0-2026-110837)

Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 13:47

Title

FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding

Summary

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:46 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-30 00:00

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110837",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:46:25.348471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:47:43.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:12.464Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-52xc-5973-w5vv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding"
        }
      ],
      "title": "FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110837",
    "datePublished": "2026-10-14T22:52:12.464Z",
    "dateReserved": "2026-10-14T22:11:15.575Z",
    "dateUpdated": "2026-10-15T13:47:43.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110838 (GCVE-0-2026-110838)

Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-16 17:15

Title

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

Summary

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 16:46 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-shad…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 3.0.0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-30 00:00

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:46:51.878958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:15:12.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user\u0027s X11 session via XTEST."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:13.434Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m998-cvfm-9444)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass"
        }
      ],
      "title": "FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110838",
    "datePublished": "2026-10-14T22:52:13.434Z",
    "dateReserved": "2026-10-14T22:11:15.575Z",
    "dateUpdated": "2026-10-16T17:15:12.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110839 (GCVE-0-2026-110839)

Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 15:33

Title

FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data

Summary

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:32 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.3.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 3.3.0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-09-30 00:00

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110839",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:32:10.467016Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:33:06.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:14.540Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-99p4-8j24-wvj4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data"
        }
      ],
      "title": "FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110839",
    "datePublished": "2026-10-14T22:52:14.540Z",
    "dateReserved": "2026-10-14T22:12:22.054Z",
    "dateUpdated": "2026-10-15T15:33:06.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111378 (GCVE-0-2026-111378)

Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 16:25

Title

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

Summary

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 16:24 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 3.0.0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-10-01 00:00

Credits

Kushalkhemka opensec-intelligence mayank-jangid-moon skigeek16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111378",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:24:47.737920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T16:25:12.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "opensec-intelligence"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        }
      ],
      "datePublic": "2026-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T01:17:46.340Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qpfh-m9w6-xf2x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser"
        }
      ],
      "title": "FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111378",
    "datePublished": "2026-10-16T01:17:46.340Z",
    "dateReserved": "2026-10-15T21:54:36.054Z",
    "dateUpdated": "2026-10-16T16:25:12.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111379 (GCVE-0-2026-111379)

Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-28 19:04

Title

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

Summary

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 17:44 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/programmervuln/freerdp-persist…	technical-descriptionexploit
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-10-01 00:00

Credits

Lidi Jie, School of Cyber Science and Engineering, Wuhan University

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111379",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T17:44:00.030060Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:55:39.255Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lidi Jie, School of Cyber Science and Engineering, Wuhan University"
        }
      ],
      "datePublic": "2026-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T19:04:34.300Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-945c-qq5h-jqwp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp"
        },
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3"
        }
      ],
      "title": "FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111379",
    "datePublished": "2026-10-16T01:17:47.354Z",
    "dateReserved": "2026-10-15T21:54:36.054Z",
    "dateUpdated": "2026-10-28T19:04:34.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111381 (GCVE-0-2026-111381)

Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-28 19:04

Title

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

Summary

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 13:56 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.32.0 (semver) Unaffected: 3.32.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-10-01 00:00

Credits

Lidi Jie, School of Cyber Science and Engineering, Wuhan University

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111381",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T13:56:34.542741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T13:56:54.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.0",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Lidi Jie, School of Cyber Science and Engineering, Wuhan University"
        }
      ],
      "datePublic": "2026-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T19:04:03.455Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-26cc-wjh8-hjw6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser"
        }
      ],
      "title": "FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111381",
    "datePublished": "2026-10-16T01:17:50.516Z",
    "dateReserved": "2026-10-15T21:54:36.054Z",
    "dateUpdated": "2026-10-28T19:04:03.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:98598

CVE-2026-109242 (GCVE-0-2026-109242)

CVE-2026-109676 (GCVE-0-2026-109676)

CVE-2026-110830 (GCVE-0-2026-110830)

CVE-2026-110833 (GCVE-0-2026-110833)

CVE-2026-110837 (GCVE-0-2026-110837)

CVE-2026-110838 (GCVE-0-2026-110838)

CVE-2026-110839 (GCVE-0-2026-110839)

CVE-2026-111378 (GCVE-0-2026-111378)

CVE-2026-111379 (GCVE-0-2026-111379)

CVE-2026-111381 (GCVE-0-2026-111381)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour