Vulnerabilities in FreeRDP

211 results
Vexday analysis

Com 147 CVEs catalogadas, o FreeRDP apresenta um volume considerável de vulnerabilidades históricas, embora a taxa de exploração ativa esteja abaixo da média geral do catálogo, sem registros no CISA KEV. O tipo de falha predominante é CWE-125 (leitura fora dos limites de buffer), padrão recorrente em clientes de protocolo remoto e que pode facilitar vazamento de dados ou instabilidade da aplicação. O CVE de maior atenção no momento é CVE-2024-32459, com score EPSS de 0,0375, e a existência de 2 CVEs com PoC pública exige monitoramento contínuo por parte de equipes de resposta. O ritmo de 15 novas CVEs nos últimos 90 dias indica superfície de ataque em expansão ativa, reforçando a necessidade de ciclos de atualização frequentes em ambientes que utilizam esta solução de desktop remoto.

CVE-2026-64621CRITICALFreeRDP before 3.28.0 Double-Free via selectedmonitorsEPSS 0.3%CVE-2026-31884MEDIUMFreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0EPSS 0.3%CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.3%CVE-2026-66402CRITICALFreeRDP before 3.29.0 TLS Certificate Identity Validation BypassEPSS 0.3%CVE-2026-31897NONEFreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`EPSS 0.3%CVE-2026-25941MEDIUMFreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds ReadEPSS 0.3%CVE-2026-22851MEDIUMFreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)EPSS 0.3%CVE-2026-33995MEDIUMFreeRDP: Possible double free in kerberos_AcceptSecurityContextEPSS 0.3%CVE-2026-67306MEDIUMFreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLEEPSS 0.3%CVE-2026-33952MEDIUMFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checksEPSS 0.3%CVE-2026-68579HIGHFreeRDP before 3.30.0 Heap Overflow via CliprdrStream_ReadEPSS 0.3%CVE-2026-67294CRITICALFreeRDP before 3.29.0 TLS Certificate EKU BypassEPSS 0.3%CVE-2026-33986HIGHFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteEPSS 0.3%CVE-2026-31885MEDIUMFreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checksEPSS 0.3%CVE-2026-27015MEDIUMFreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)EPSS 0.3%CVE-2026-33977MEDIUMFreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)EPSS 0.3%CVE-2026-67303MEDIUMFreeRDP before 3.29.0 Denial of Service via serial DeviceControlEPSS 0.2%CVE-2026-91962MEDIUMFreeRDP before 3.31.0 Integer Overflow via audin Apple backendsEPSS 0.2%CVE-2025-68118MEDIUMPotential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf UsageEPSS 0.2%CVE-2026-26271MEDIUMBuffer Overread in FreeRDP Icon ProcessingEPSS 0.2%