CVE-2022-24882criticalCWE-287

CVE-2022-24882: critical vulnerability in FreeRDP

Server side NTLM does not properly check parameters in FreeRDP

Published · Updated

Follow this CVE+ Monitor FreeRDP+ Monitor freerdp2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 2.8%
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
FreeRDP · FreeRDP
Related CVEs — FreeRDP

In the same product, most dangerous first.

CVE-2026-45700HIGHHeap-buffer-overflow write in planar bitmap decoderEPSS 6.1%CVE-2026-44420HIGHFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSEPSS 4.6%CVE-2024-32459CRITICALFreeRDP Out-Of-Bounds Read in ncrush_decompressEPSS 3.7%CVE-2022-24883HIGHFreeRDP Server authentication might allow invalid credentials to passEPSS 2.3%CVE-2020-11019MEDIUMOut of bound read in update_recv in FreeRDPEPSS 2.3%CVE-2024-32039CRITICALFreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_dataEPSS 2.3%