vciy

CVEs we hold for Freerdp

Records whose assigning authority named Freerdp as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-91964FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingTokenFreeRDP
CVE-2026-91963FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcFreeRDP
CVE-2026-91962FreeRDP before 3.31.0 Integer Overflow via audin Apple backendsFreeRDP
CVE-2026-91961FreeRDP before 3.31.0 Denial of Service via URBDRCFreeRDP
CVE-2026-91960FreeRDP before 3.31.0 Integer Overflow Double FreeFreeRDP
CVE-2026-91959FreeRDP before 3.31.0 Buffer Over-read via RTS GatewayFreeRDP
CVE-2026-91958FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor IndexFreeRDP
CVE-2026-91957FreeRDP before 3.31.0 Use-After-Free via smartcard workerFreeRDP
CVE-2026-91956FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRCFreeRDP
CVE-2026-91955FreeRDP before 3.31.0 Denial of Service via Desktop DimensionsFreeRDP
CVE-2026-91954FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodecFreeRDP
CVE-2026-91953FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFOFreeRDP
CVE-2026-91952FreeRDP before 3.31.0 Denial of Service via pool_decode_rectFreeRDP
CVE-2026-91951FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrcFreeRDP
CVE-2026-91950FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 WraparoundFreeRDP
CVE-2026-91949FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation BypassFreeRDP
CVE-2026-91948FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOLFreeRDP
CVE-2026-91947FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCFreeRDP
CVE-2026-91946FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphicsFreeRDP
CVE-2026-91945FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATRFreeRDP
CVE-2026-85090FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444FreeRDP
CVE-2026-85089FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memoryFreeRDP
CVE-2026-73242FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`FreeRDP
CVE-2026-73241FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step…FreeRDP
CVE-2026-68580FreeRDP before 3.29.0 Integer Overflow via Audio Input ChannelFreeRDP
CVE-2026-68579FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_ReadFreeRDP
CVE-2026-67306FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLEFreeRDP
CVE-2026-67305FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via CliprdrFreeRDP
CVE-2026-67304FreeRDP before 3.29.0 NULL Dereference via smartcard cleanupFreeRDP
CVE-2026-67303FreeRDP before 3.29.0 Denial of Service via serial DeviceControlFreeRDP
CVE-2026-67302FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of serviceFreeRDP
CVE-2026-67301FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxyFreeRDP
CVE-2026-67300FreeRDP before 3.29.0 Use-After-Free via async message proxyFreeRDP
CVE-2026-67299FreeRDP before 3.29.0 Use-After-Free via WindowIcon async messageFreeRDP
CVE-2026-67298FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength UnderflowFreeRDP
CVE-2026-67297FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP responseFreeRDP
CVE-2026-67296FreeRDP before 3.29.0 Denial of Service via RDPEI PDUFreeRDP
CVE-2026-67295FreeRDP before 3.29.0 Path Traversal via drive redirectionFreeRDP
CVE-2026-67294FreeRDP before 3.29.0 TLS Certificate EKU BypassFreeRDP
CVE-2026-67293FreeRDP before 3.29.0 Improper Certificate Hostname ValidationFreeRDP
CVE-2026-67292FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosureFreeRDP
CVE-2026-67291FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADDFreeRDP
CVE-2026-67290FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMFFreeRDP
CVE-2026-67289FreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionFreeRDP
CVE-2026-67288FreeRDP before 3.29.0 Denial of Service via smartcard cacheFreeRDP
CVE-2026-66402FreeRDP before 3.29.0 TLS Certificate Identity Validation BypassFreeRDP
CVE-2026-66401FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264FreeRDP
CVE-2026-64624FreeRDP RDP File Parser Remote Code Execution via CLI OptionsFreeRDP
CVE-2026-64621FreeRDP before 3.28.0 Double-Free via selectedmonitorsFreeRDP
CVE-2026-64620FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_commonFreeRDP
CVE-2026-63652FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDUFreeRDP
CVE-2026-63633FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→clientFreeRDP
CVE-2026-63117FreeRDP: Denial of service through ADPCM frame size calculationFreeRDP
CVE-2026-57158FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530FreeRDP
CVE-2026-57157Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelNameFreeRDP
CVE-2026-57156FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsingFreeRDP
CVE-2026-56297FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel CallbackFreeRDP
CVE-2026-55827FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decodeFreeRDP
CVE-2026-55648FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds CheckFreeRDP
CVE-2026-55564FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragmentsFreeRDP
CVE-2026-55194FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatchFreeRDP
CVE-2026-55193FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_fragFreeRDP
CVE-2026-55192FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatchFreeRDP
CVE-2026-55191FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocationFreeRDP
CVE-2026-45700Heap-buffer-overflow write in planar bitmap decoderFreeRDP
CVE-2026-44422FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusionFreeRDP
CVE-2026-44421FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypassFreeRDP
CVE-2026-44420FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSFreeRDP
CVE-2026-40254FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..FreeRDP
CVE-2026-40033FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypassFreeRDP
CVE-2026-33995FreeRDP: Possible double free in kerberos_AcceptSecurityContextFreeRDP
CVE-2026-33987FreeRDP: Persistent Cache bmpSize Desync - Heap OOB WriteFreeRDP
CVE-2026-33986FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteFreeRDP
CVE-2026-33985FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB ReadFreeRDP
CVE-2026-33984FreeRDP: ClearCodec resize_vbar_entry() Heap OOB WriteFreeRDP
CVE-2026-33983FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoSFreeRDP
CVE-2026-33982FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB ReadFreeRDP
CVE-2026-33977FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)FreeRDP
CVE-2026-33952FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checksFreeRDP
CVE-2026-31897FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`FreeRDP
CVE-2026-31885FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checksFreeRDP
CVE-2026-31884FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0FreeRDP
CVE-2026-31883FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow writeFreeRDP
CVE-2026-31806FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap DimensionsFreeRDP
CVE-2026-29776FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryFreeRDP
CVE-2026-29775FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheIdFreeRDP
CVE-2026-29774FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRectsFreeRDP
CVE-2026-27951FreeRDP has possible Integer overflow in Stream_EnsureCapacityFreeRDP
CVE-2026-27950FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong FileFreeRDP
CVE-2026-27015FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)FreeRDP
CVE-2026-26986FreeRDP has heap-use-after-free in rail_window_freeFreeRDP
CVE-2026-26965FreeRDP has Out-of-bounds WriteFreeRDP
CVE-2026-26955FreeRDP has Out-of-bounds WriteFreeRDP
CVE-2026-26271Buffer Overread in FreeRDP Icon ProcessingFreeRDP
CVE-2026-25997FreeRDP has heap-use-after-free in xf_clipboard_format_equalFreeRDP
CVE-2026-25959FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_FreeRDP
CVE-2026-25955FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)FreeRDP
CVE-2026-25954FreeRDP has heap-use-after-free in xf_rail_server_local_move_sizeFreeRDP
CVE-2026-25953FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)FreeRDP
CVE-2026-25952FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfoFreeRDP
CVE-2026-25942FreeRDP has global-buffer-overflow in xf_rail_server_execute_resultFreeRDP
CVE-2026-25941FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds ReadFreeRDP
CVE-2026-24684FreeRDP has a Heap-use-after-free in play_threadFreeRDP
CVE-2026-24683FreeRDP has a heap-use-after-free in ainput_send_input_eventFreeRDP
CVE-2026-24682FreeRDP has a Heap-buffer-overflow in audio_formats_freeFreeRDP
CVE-2026-24681FreeRDP has a heap-use-after-free in urb_bulk_transfer_cbFreeRDP
CVE-2026-24680FreeRDP has a heap-use-after-free in update_pointer_new(SDL)FreeRDP
CVE-2026-24679FreeRDP has a heap-buffer-overflow in urb_select_interfaceFreeRDP
CVE-2026-24678FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_threadFreeRDP
CVE-2026-24677FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264FreeRDP
CVE-2026-24676FreeRDP has a heap-use-after-free in audio_format_compatibleFreeRDP
CVE-2026-24675FreeRDP has a Heap-use-after-free in urb_select_interfaceFreeRDP
CVE-2026-24491FreeRDP has a heap-use-after-free in video_timerFreeRDP
CVE-2026-23948FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()FreeRDP
CVE-2026-23884Heap-use-after-free in gdi_set_boundsFreeRDP
CVE-2026-23883Heap-use-after-free in update_pointer_newFreeRDP
CVE-2026-23732FreeRDP has heap-buffer-overflow in Glyph_AllocFreeRDP
CVE-2026-23534FreeRDP has heap-buffer-overflow in clear_decompress_bands_dataFreeRDP
CVE-2026-23533FreeRDP has heap-buffer-overflow in clear_decompress_residual_dataFreeRDP
CVE-2026-23532FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurfaceFreeRDP
CVE-2026-23531FreeRDP has heap-buffer-overflow in clear_decompressFreeRDP
CVE-2026-23530FreeRDP has heap-buffer-overflow in planar_decompress_plane_rleFreeRDP
CVE-2026-22859FreeRDP has a heap-buffer-overflow in urb_select_configurationFreeRDP
CVE-2026-22858FreeRDP has a global-buffer-overflow in crypto_base64_decodeFreeRDP
CVE-2026-22857FreeRDP has a heap-use-after-free in irp_thread_funcFreeRDP
CVE-2026-22856FreeRDP has a heap-use-after-free in create_irp_threadFreeRDP
CVE-2026-22855FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_callFreeRDP
CVE-2026-22854FreeRDP has a heap-buffer-overflow in drive_process_irp_readFreeRDP
CVE-2026-22853FreeRDP has a heap-buffer-overflow in ndr_read_uint8ArrayFreeRDP
CVE-2026-22852FreeRDP has a heap-buffer-overflow in audin_process_formatsFreeRDP
CVE-2026-22851FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)FreeRDP
CVE-2025-68118Potential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf UsageFreeRDP
CVE-2024-32662FreeRDP rdp_redirection_read_base64_wchar out of bound readFreeRDP
CVE-2024-32661FreeRDP rdp_write_logon_info_v1 NULL accessFreeRDP
CVE-2024-32660FreeRDP zgfx_decompress out of memory vulnerabilityFreeRDP
CVE-2024-32659freerdp_image_copy out of bound readFreeRDP
CVE-2024-32658FreeRDP ExtractRunLengthRegular* out of bound readFreeRDP
CVE-2024-32460FreeRDP Out-Of-Bounds Read in interleaved_decompressFreeRDP
CVE-2024-32459FreeRDP Out-Of-Bounds Read in ncrush_decompressFreeRDP
CVE-2024-32458FreeRDP Out-Of-Bounds Read in planar_skip_plane_rleFreeRDP
CVE-2024-32041FreeRDP OutOfBound Read in zgfx_decompress_segmentFreeRDP
CVE-2024-32040FreeRDP vulnerable to integer underflow in nsc_rle_decodeFreeRDP
CVE-2024-32039FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_dataFreeRDP
CVE-2024-22211FreeRDP integer Overflow leading to Heap OverflowFreeRDP
CVE-2023-40589FreeRDP Global-Buffer-Overflow in ncrush_decompressFreeRDP
CVE-2023-40576Out-Of-Bounds Read in FreeRDPFreeRDP
CVE-2023-40575Out-Of-Bounds Read in FreeRDPFreeRDP
CVE-2023-40574Out-Of-Bounds Write in FreeRDPFreeRDP
CVE-2023-40569Out-Of-Bounds Write in FreeRDPFreeRDP
CVE-2023-40567Out-Of-Bounds Write in FreeRDPFreeRDP
CVE-2023-40188Out-Of-Bounds Read in FreeRDPFreeRDP
CVE-2023-40187Use-After-Free in FreeRDPFreeRDP
CVE-2023-40186IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDPFreeRDP
CVE-2023-40181Integer-Underflow leading to Out-Of-Bound Read in FreeRDPFreeRDP
CVE-2023-39356Missing offset validation leading to Out-of-Bounds Read in FreeRDPFreeRDP
CVE-2023-39355FreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICSFreeRDP
CVE-2023-39354FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_dataFreeRDP
CVE-2023-39353Missing offset validation leading to Out Of Bound Read in FreeRDPFreeRDP
CVE-2023-39352Invalid offset validation leading to Out Of Bound Write in FreeRDPFreeRDP
CVE-2023-39351FreeRDP Null Pointer Dereference leading denial of serviceFreeRDP
CVE-2023-39350Incorrect offset calculation leading to denial of service in FreeRDPFreeRDP
CVE-2022-41877Missing input length validation in `drive` channel in FreeRDPFreeRDP
CVE-2022-39347Missing path sanitation with `drive` channel in FreeRDPFreeRDP
CVE-2022-39320Heap buffer overflow in urbdrc channelFreeRDP
CVE-2022-39319Missing length validation in urbdrc channel in FreeRDPFreeRDP
CVE-2022-39318Division by zero in urbdrc channel in FreeRDPFreeRDP
CVE-2022-39317Out of bounds read in zgfx decoder in FreeRDPFreeRDP
CVE-2022-39316Out of bound read in FreeRDPFreeRDP
CVE-2022-39283FreeRDP may read and display out of bounds dataFreeRDP
CVE-2022-39282RDP client: Read of uninitialized memory with parallel port redirectionFreeRDP
CVE-2022-24883FreeRDP Server authentication might allow invalid credentials to passFreeRDP
CVE-2022-24882Server side NTLM does not properly check parameters in FreeRDPFreeRDP
CVE-2021-41160Improper region checks in FreeRDP allow out of bound write to memoryFreeRDP
CVE-2021-41159Improper client input validation for FreeRDP gateway connections allows to overwrite memoryFreeRDP
CVE-2020-4033OOB Read in RLEDECOMPRESS in FreeRDPFreeRDP
CVE-2020-4032Integer casting vulnerability in `update_recv_secondary_order` in FreeRDPFreeRDP
CVE-2020-4031Use-After-Free in gdi_SelectObject in FreeRDPFreeRDP
CVE-2020-4030OOB read in `TrioParse` in FreeRDPFreeRDP
CVE-2020-15103Integer Overflow in FreeRDPFreeRDP
CVE-2020-11099OOB Read in license_read_new_or_upgrade_license_packet in FreeRDPFreeRDP
CVE-2020-11098Out-of-bound read in glyph_cache_put in FreeRDPFreeRDP
CVE-2020-11097OOB read in ntlm_av_pair_get in FreeRDPFreeRDP
CVE-2020-11096Global OOB read in update_read_cache_bitmap_v3_order in FreeRDPFreeRDP
CVE-2020-11095Global OOB read in update_recv_primary_order in FreeRDPFreeRDP
CVE-2020-11089Out-of-bound read in FreeRDPFreeRDP
CVE-2020-11088Out-of-bound read in FreeRDPFreeRDP
CVE-2020-11087Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11086Out-of-bounds Read in FreeRDP `ntlm_read_ntlm_v2_response`FreeRDP
CVE-2020-11085Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11058Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDPFreeRDP
CVE-2020-11049Out-of-bounds Read in FreeRDPrdp_read_share_control_headerFreeRDP
CVE-2020-11048Out-of-bounds Read in FreeRDPrdp_read_flow_control_pduFreeRDP
CVE-2020-11047Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11046Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDPFreeRDP
CVE-2020-11045Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11044Double Free in FreeRDPFreeRDP
CVE-2020-11043Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11042Out-of-bounds Read in FreeRDPFreeRDP
CVE-2020-11041Improper Validation of Array Index in FreeRDPFreeRDP
CVE-2020-11040Out-of-bounds Read in FreeRDPFreeRDP

200 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.