Vulnerabilities in FreeRDP
322 resultsCVE-2026-25959MEDIUMFreeRDP has heap-use-after-free in xf_cliprdr_provide_data_EPSS 0.7%CVE-2026-26955HIGHFreeRDP has Out-of-bounds WriteEPSS 0.6%CVE-2026-55191HIGHFreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocationEPSS 0.6%CVE-2026-63633HIGHFreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→clientEPSS 0.6%CVE-2026-55194HIGHFreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatchEPSS 0.6%CVE-2026-67290HIGHFreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMFEPSS 0.6%CVE-2026-91964HIGHFreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingTokenEPSS 0.6%CVE-2026-24684HIGHFreeRDP has a Heap-use-after-free in play_threadEPSS 0.6%CVE-2026-91948HIGHFreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOLEPSS 0.6%CVE-2026-63652HIGHFreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDUEPSS 0.6%CVE-2026-91945HIGHFreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATREPSS 0.6%CVE-2026-91949CRITICALFreeRDP 3.0.0 through 3.30.0 Protocol Negotiation BypassEPSS 0.6%CVE-2026-23732MEDIUMFreeRDP has heap-buffer-overflow in Glyph_AllocEPSS 0.6%CVE-2026-114045HIGHFreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_formatEPSS 0.6%CVE-2026-121964HIGHFreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragmentEPSS 0.6%CVE-2026-91955HIGHFreeRDP before 3.31.0 Denial of Service via Desktop DimensionsEPSS 0.6%CVE-2026-25955MEDIUMFreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)EPSS 0.6%CVE-2026-121953CRITICALFreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel CloseEPSS 0.6%CVE-2026-26986MEDIUMFreeRDP has heap-use-after-free in rail_window_freeEPSS 0.6%CVE-2026-121960HIGHFreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequestEPSS 0.6%