BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

FreeRDP

FreeRDP Security Releases - October 2026

freerdp-2026-10 Oct 1, 2026 Source: Vendor

FreeRDP security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-109240
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

94 lines
All 94 CVEs 94 Additional recognition 0 Unclaimed only
Showing 1–50 of 94 , page 1 of 2
CVE-2026-109240 BR2026-0000-027146 FreeRDP unclaimed
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. At...
Credited as gulamovzavohir02-glitch
CVE-2026-109241 BR2026-0000-027147 FreeRDP unclaimed
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Atta...
Credited as w226688
CVE-2026-109242 BR2026-0000-027148 FreeRDP unclaimed
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP serve...
Credited as router0mail
CVE-2026-109243 BR2026-0000-027149 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. A...
Credited as Kushalkhemka
CVE-2026-109243 BR2026-0000-027150 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. A...
Credited as opensec-intelligence
CVE-2026-109243 BR2026-0000-027151 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. A...
Credited as mayank-jangid-moon
CVE-2026-109243 BR2026-0000-027152 FreeRDP unclaimed
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. A...
Credited as skigeek16
CVE-2026-109244 BR2026-0000-027153 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix ...
Credited as Kushalkhemka
CVE-2026-109244 BR2026-0000-027154 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix ...
Credited as opensec-intelligence
CVE-2026-109244 BR2026-0000-027155 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix ...
Credited as mayank-jangid-moon
CVE-2026-109244 BR2026-0000-027156 FreeRDP unclaimed
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix ...
Credited as skigeek16
CVE-2026-109245 BR2026-0000-027157 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server...
Credited as DavidKorczynski
CVE-2026-109246 BR2026-0000-027158 FreeRDP unclaimed
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-fl...
Credited as DavidKorczynski
CVE-2026-109247 BR2026-0000-027159 FreeRDP unclaimed
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName va...
Credited as DavidKorczynski
CVE-2026-109248 BR2026-0000-027160 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with...
Credited as DavidKorczynski
CVE-2026-109249 BR2026-0000-027161 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting th...
Credited as DavidKorczynski
CVE-2026-109250 BR2026-0000-027162 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. A...
Credited as DavidKorczynski
CVE-2026-109251 BR2026-0000-027163 FreeRDP unclaimed
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arith...
Credited as DavidKorczynski
CVE-2026-109252 BR2026-0000-027164 FreeRDP unclaimed
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data....
Credited as HAN-BAMBO
CVE-2026-109253 BR2026-0000-027165 FreeRDP unclaimed
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised...
Credited as HAN-BAMBO
CVE-2026-109254 BR2026-0000-027166 FreeRDP unclaimed
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP s...
Credited as smaeljaish771
CVE-2026-109254 BR2026-0000-027167 FreeRDP unclaimed
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP s...
Credited as KeenSecurityLab
CVE-2026-109255 BR2026-0000-027168 FreeRDP unclaimed
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attac...
Credited as D7EAD
CVE-2026-109256 BR2026-0000-027169 FreeRDP unclaimed
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a l...
Credited as kimaiden1984-boop
CVE-2026-109257 BR2026-0000-027170 FreeRDP unclaimed
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RD...
Credited as kimaiden1984-boop
CVE-2026-109676 BR2026-0000-028224 FreeRDP unclaimed
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operati...
Credited as alexdowad
CVE-2026-109677 BR2026-0000-028225 FreeRDP unclaimed
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers...
Credited as alexdowad
CVE-2026-109678 BR2026-0000-028226 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination...
Credited as Kushalkhemka
CVE-2026-109678 BR2026-0000-028227 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination...
Credited as mayank-jangid-moon
CVE-2026-109678 BR2026-0000-028228 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination...
Credited as skigeek16
CVE-2026-109678 BR2026-0000-028229 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination...
Credited as opensec-intelligence
CVE-2026-109679 BR2026-0000-028230 FreeRDP unclaimed
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway ...
Credited as Kushalkhemka
CVE-2026-109679 BR2026-0000-028231 FreeRDP unclaimed
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway ...
Credited as opensec-intelligence
CVE-2026-109679 BR2026-0000-028232 FreeRDP unclaimed
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway ...
Credited as mayank-jangid-moon
CVE-2026-109679 BR2026-0000-028233 FreeRDP unclaimed
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway ...
Credited as skigeek16
CVE-2026-109680 BR2026-0000-028234 FreeRDP unclaimed
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as i...
Credited as Kushalkhemka
CVE-2026-109680 BR2026-0000-028235 FreeRDP unclaimed
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as i...
Credited as opensec-intelligence
CVE-2026-109680 BR2026-0000-028236 FreeRDP unclaimed
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as i...
Credited as mayank-jangid-moon
CVE-2026-109680 BR2026-0000-028237 FreeRDP unclaimed
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as i...
Credited as skigeek16
CVE-2026-109938 BR2026-0000-028238 FreeRDP unclaimed
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
Credited as Kushalkhemka
CVE-2026-109938 BR2026-0000-028239 FreeRDP unclaimed
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
Credited as opensec-intelligence
CVE-2026-109938 BR2026-0000-028240 FreeRDP unclaimed
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
Credited as mayank-jangid-moon
CVE-2026-109938 BR2026-0000-028241 FreeRDP unclaimed
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
Credited as skigeek16
CVE-2026-109939 BR2026-0000-028242 FreeRDP unclaimed
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACH...
Credited as Kushalkhemka
CVE-2026-109939 BR2026-0000-028243 FreeRDP unclaimed
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACH...
Credited as mayank-jangid-moon
CVE-2026-109939 BR2026-0000-028244 FreeRDP unclaimed
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACH...
Credited as skigeek16
CVE-2026-109939 BR2026-0000-028245 FreeRDP unclaimed
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACH...
Credited as opensec-intelligence
CVE-2026-109940 BR2026-0000-028246 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which c...
Credited as Kushalkhemka
CVE-2026-109940 BR2026-0000-028247 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which c...
Credited as opensec-intelligence
CVE-2026-109940 BR2026-0000-028248 FreeRDP unclaimed
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which c...
Credited as mayank-jangid-moon