FR
Product
FreeRDP
305
CVEs
0
On KEV
9.8
Max CVSS
69
New 30D
Severity mix
Critical 68High 96Medium 120Low 19
Watch
Add FreeRDP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-91961 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Denial of Service via URBDRC Affected: before 3.31.0 |
| CVE-2026-91960 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Integer Overflow Double Free Affected: before 3.31.0 |
| CVE-2026-91959 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway Affected: before 3.31.0 |
| CVE-2026-91956 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC Affected: before 3.31.0 |
| CVE-2026-91954 | 6.5 | Sep 15 | FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec Affected: before 3.31.0 |
| CVE-2026-91953 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO Affected: before 3.31.0 |
| CVE-2026-91952 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Denial of Service via pool_decode_rect Affected: before 3.31.0 |
| CVE-2026-91951 | 6.5 | Sep 15 | FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc Affected: 3.14.0 before 3.31.0 |
| CVE-2026-91950 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound Affected: before 3.31.0 |
| CVE-2026-91946 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics Affected: 2.0.0 before 3.31.0 |
| CVE-2026-91945 | 6.5 | Sep 15 | FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR Affected: 3.28.0 before 3.31.0 |
| CVE-2026-85089 | 6.5 | Sep 3 | FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory Affected: 3.0.0 before 3.31.0 |
| CVE-2026-63652 | 6.5 | Aug 19 | FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU Affected: < 3.28.0 |
| CVE-2026-63117 | 6.5 | Aug 19 | FreeRDP: Denial of service through ADPCM frame size calculation Affected: < 3.28.0 |
| CVE-2026-67292 | 6.5 | Aug 1 | FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure Affected: before 3.29.0 |
| CVE-2026-67302 | 6.5 | Aug 1 | FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service Affected: before 3.29.0 |
| CVE-2026-57157 | 6.5 | Jul 10 | Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName Affected: < 3.28.0 |
| CVE-2026-33983 | 6.5 | Mar 30 | FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS Affected: < 3.24.2 |
| CVE-2026-33952 | 6.5 | Mar 30 | FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks Affected: < 3.24.2 |
| CVE-2026-33977 | 6.5 | Mar 30 | FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331) Affected: < 3.24.2 |
| CVE-2026-27015 | 6.5 | Feb 25 | FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS) Affected: < 3.23.0 |
| CVE-2025-4478 | 6.5 | May 16 | Gnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of service Affected: 3.0.0 before 3.16.0 |
| CVE-2020-4033 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS Affected: before 2.1.2 |
| CVE-2020-4030 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse Affected: before 2.1.2 |
| CVE-2020-11099 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet Affected: before 2.1.2 |
| CVE-2020-11098 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put Affected: before 2.1.2 |
| CVE-2020-11096 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order Affected: before 2.1.2 |
| CVE-2020-11019 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index Affected: before 2.1.0 |
| CVE-2020-11018 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed Affected: through 2.0.0 |
| CVE-2020-11017 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server Affected: before 2.1.0 |
| CVE-2020-11522 | 6.5 | May 15 | libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read Affected: after 1.0.0 before 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more |
| CVE-2018-1000852 | 6.5 | Dec 20 | FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c,… Affected: before 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-91962 | 6.3 | Sep 15 | FreeRDP before 3.31.0 Integer Overflow via audin Apple backends Affected: before 3.31.0 |
| CVE-2026-67295 | 6.3 | Aug 1 | FreeRDP before 3.29.0 Path Traversal via drive redirection Affected: before 3.29.0 |
| CVE-2026-40254 | 6.1 | Apr 24 | FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal .. Affected: < 3.25.0 |
| CVE-2026-109945 | 5.9 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109254 | 5.9 | Oct 12 | FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path Affected: 2.1.0 before 3.32.0 |
| CVE-2026-67294 | 5.9 | Aug 1 | FreeRDP before 3.29.0 TLS Certificate EKU Bypass Affected: before 3.29.0 |
| CVE-2026-22851 | 5.9 | Jan 14 | FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary) Affected: < 3.20.1 |
| CVE-2020-11047 | 5.9 | May 7 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results Affected: after 1.1.0 before 2.0.0 |
| CVE-2020-11042 | 5.9 | May 7 | In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info Affected: after 1.1.0 before 2.0.0 |
| CVE-2017-2839 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2838 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2837 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2836 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2026-110835 | 5.8 | Oct 14 | FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token Affected: 3.0.0 before 3.32.0 |
| CVE-2022-39318 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39347 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39316 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2026-109249 | 5.5 | Oct 12 | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing Affected: 3.0.0 before 3.32.0 |
