FR
Product
FreeRDP
305
CVEs
0
On KEV
9.8
Max CVSS
69
New 30D
Severity mix
Critical 68High 96Medium 120Low 19
Watch
Add FreeRDP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-67292 | 6.5 | Aug 1 | FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure Affected: before 3.29.0 |
| CVE-2026-67302 | 6.5 | Aug 1 | FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service Affected: before 3.29.0 |
| CVE-2026-57157 | 6.5 | Jul 10 | Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName Affected: < 3.28.0 |
| CVE-2026-33983 | 6.5 | Mar 30 | FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS Affected: < 3.24.2 |
| CVE-2026-33952 | 6.5 | Mar 30 | FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks Affected: < 3.24.2 |
| CVE-2026-33977 | 6.5 | Mar 30 | FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331) Affected: < 3.24.2 |
| CVE-2026-27015 | 6.5 | Feb 25 | FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS) Affected: < 3.23.0 |
| CVE-2025-4478 | 6.5 | May 16 | A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault Affected: 3.0.0 before 3.16.0 |
| CVE-2020-4033 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS Affected: before 2.1.2 |
| CVE-2020-4030 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse Affected: before 2.1.2 |
| CVE-2020-11099 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet Affected: before 2.1.2 |
| CVE-2020-11098 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put Affected: before 2.1.2 |
| CVE-2020-11096 | 6.5 | Jun 22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order Affected: before 2.1.2 |
| CVE-2020-11019 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index Affected: before 2.1.0 |
| CVE-2020-11018 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed Affected: through 2.0.0 |
| CVE-2020-11017 | 6.5 | May 29 | In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server Affected: before 2.1.0 |
| CVE-2020-11522 | 6.5 | May 15 | libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read Affected: after 1.0.0 before 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more |
| CVE-2018-1000852 | 6.5 | Dec 20 | FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c,… Affected: before 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-91962 | 6.3 | Sep 15 | FreeRDP before 3.31.0 Integer Overflow via audin Apple backends Affected: before 3.31.0 |
| CVE-2026-67295 | 6.3 | Aug 1 | FreeRDP before 3.29.0 Path Traversal via drive redirection Affected: before 3.29.0 |
| CVE-2026-40254 | 6.1 | Apr 24 | FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal .. Affected: < 3.25.0 |
| CVE-2026-109945 | 5.9 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109254 | 5.9 | Oct 12 | FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path Affected: 2.1.0 before 3.32.0 |
| CVE-2026-67294 | 5.9 | Aug 1 | FreeRDP before 3.29.0 TLS Certificate EKU Bypass Affected: before 3.29.0 |
| CVE-2026-22851 | 5.9 | Jan 14 | FreeRDP is a free implementation of the Remote Desktop Protocol Affected: before 3.20.1 |
| CVE-2020-11047 | 5.9 | May 7 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results Affected: after 1.1.0 before 2.0.0 |
| CVE-2020-11042 | 5.9 | May 7 | In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info Affected: after 1.1.0 before 2.0.0 |
| CVE-2017-2839 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2838 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2837 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2017-2836 | 5.9 | Apr 24 | An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11 Affected: 2.0.0 |
| CVE-2026-110835 | 5.8 | Oct 14 | FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token Affected: 3.0.0 before 3.32.0 |
| CVE-2022-39318 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39347 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39316 | 5.7 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2026-109249 | 5.5 | Oct 12 | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing Affected: 3.0.0 before 3.32.0 |
| CVE-2020-11089 | 5.5 | May 29 | In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write,… Affected: before 2.1.0 |
| CVE-2020-13397 | 5.5 | May 22 | An issue was discovered in FreeRDP before 2.1.1 Affected: before 2.1.1 |
| CVE-2026-85090 | 5.4 | Sep 3 | FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 Affected: 3.0.0 before 3.31.0 |
| CVE-2026-67306 | 5.4 | Aug 1 | FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE Affected: before 3.29.0 |
| CVE-2020-11097 | 5.4 | Jun 22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array… Affected: before 2.1.2 |
| CVE-2020-11095 | 5.4 | Jun 22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array… Affected: before 2.1.2 |
| CVE-2020-11088 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage Affected: before 2.1.0 |
| CVE-2020-11087 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage Affected: before 2.1.0 |
| CVE-2020-11086 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure Affected: before 2.1.0 |
| CVE-2020-11038 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists Affected: before 2.1.0 |
| CVE-2026-114044 | 5.3 | Oct 21 | FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline Affected: before 3.32.1 |
| CVE-2026-111374 | 5.3 | Oct 16 | FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest Affected: 3.30.0 before 3.32.0 |
| CVE-2026-109953 | 5.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109952 | 5.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response Affected: 3.0.0 before 3.32.0 |
