FR
Product
FreeRDP
305
CVEs
0
On KEV
9.8
Max CVSS
69
New 30D
Severity mix
Critical 68High 96Medium 120Low 19
Watch
Add FreeRDP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11089 | 5.5 | May 29 | In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write,… Affected: before 2.1.0 |
| CVE-2020-13397 | 5.5 | May 22 | An issue was discovered in FreeRDP before 2.1.1 Affected: before 2.1.1 |
| CVE-2026-85090 | 5.4 | Sep 3 | FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 Affected: 3.0.0 before 3.31.0 |
| CVE-2026-67306 | 5.4 | Aug 1 | FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE Affected: before 3.29.0 |
| CVE-2020-11097 | 5.4 | Jun 22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array… Affected: before 2.1.2 |
| CVE-2020-11095 | 5.4 | Jun 22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array… Affected: before 2.1.2 |
| CVE-2020-11088 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage Affected: before 2.1.0 |
| CVE-2020-11087 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage Affected: before 2.1.0 |
| CVE-2020-11086 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure Affected: before 2.1.0 |
| CVE-2020-11038 | 5.4 | May 29 | In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists Affected: before 2.1.0 |
| CVE-2026-114044 | 5.3 | Oct 21 | FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline Affected: before 3.32.1 |
| CVE-2026-111374 | 5.3 | Oct 16 | FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest Affected: 3.30.0 before 3.32.0 |
| CVE-2026-109953 | 5.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109952 | 5.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109951 | 5.3 | Oct 13 | FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name Affected: 3.17.1 before 3.32.0 |
| CVE-2026-109679 | 5.3 | Oct 13 | FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response Affected: 3.0.0-beta4 before 3.32.0 |
| CVE-2026-109253 | 5.3 | Oct 12 | FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read Affected: 3.9.0 before 3.32.0 |
| CVE-2026-109252 | 5.3 | Oct 12 | FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME Affected: 3.9.0 before 3.32.0 |
| CVE-2026-109251 | 5.3 | Oct 12 | FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry Affected: before 3.32.0 |
| CVE-2026-33995 | 5.3 | Mar 30 | FreeRDP: Possible double free in kerberos_AcceptSecurityContext Affected: < 3.24.2 |
| CVE-2026-26271 | 5.3 | Feb 25 | Buffer Overread in FreeRDP Icon Processing Affected: < 3.23.0 |
| CVE-2026-111376 | 5.0 | Oct 16 | FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE Affected: 3.30.0 before 3.32.0 |
| CVE-2026-109940 | 4.6 | Oct 13 | FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name Affected: 3.0.0-beta1 before 3.32.0 |
| CVE-2022-39319 | 4.6 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39317 | 4.6 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-41877 | 4.6 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2022-39320 | 4.6 | Nov 16 | FreeRDP is a free remote desktop protocol library and clients Affected: before 2.9.0 |
| CVE-2026-109243 | 4.4 | Oct 12 | FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File Affected: 3.0.0 before 3.32.0 |
| CVE-2026-110831 | 4.3 | Oct 14 | FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE Affected: 3.13.0 before 3.32.0 |
| CVE-2026-109950 | 4.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages Affected: 3.0.0 before 3.32.0 |
| CVE-2026-109948 | 4.3 | Oct 13 | FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection Affected: 3.0.0 before 3.32.0 |
| CVE-2026-67303 | 4.3 | Aug 1 | FreeRDP before 3.29.0 Denial of Service via serial DeviceControl Affected: before 3.29.0 |
| CVE-2020-4032 | 4.3 | Jun 22 | In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order Affected: before 2.1.2 |
| CVE-2026-67293 | 4.2 | Aug 1 | FreeRDP before 3.29.0 Improper Certificate Hostname Validation Affected: before 3.29.0 |
| CVE-2020-15103 | 3.5 | Jul 27 | In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel Affected: through 2.1.2 |
| CVE-2020-11085 | 3.5 | May 29 | In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list Affected: before 2.1.0 |
| CVE-2020-11045 | 3.3 | May 7 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer Affected: 1.1.0 before 2.0.0 |
| CVE-2026-109247 | 3.1 | Oct 12 | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName Affected: before 3.32.0 |
| CVE-2026-109241 | 3.1 | Oct 12 | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel Affected: before 3.32.0 |
| CVE-2026-109240 | 3.1 | Oct 12 | FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer Affected: 3.11.0 before 3.32.1 |
| CVE-2026-91957 | 3.1 | Sep 15 | FreeRDP before 3.31.0 Use-After-Free via smartcard worker Affected: before 3.31.0 |
| CVE-2026-29776 | 3.1 | Mar 13 | FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library Affected: < 3.24.0 |
| CVE-2020-11043 | 2.7 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset Affected: before 2.1.0 |
| CVE-2020-11040 | 2.7 | May 29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color Affected: before 2.1.0 |
| CVE-2020-11041 | 2.7 | May 29 | In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...) Affected: before 2.1.0 |
| CVE-2020-11526 | 2.2 | May 15 | libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read Affected: after 1.1.0 before 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more |
| CVE-2020-11525 | 2.2 | May 15 | libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read Affected: after 1.0.0 through 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more |
| CVE-2020-11058 | 2.2 | May 12 | In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read Affected: after 1.1.0 through 2.0.0 |
| CVE-2020-11049 | 2.2 | May 7 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser Affected: after 1.1.0 before 2.0.0 |
| CVE-2020-11048 | 2.2 | May 7 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read Affected: 1.0.0 before 2.0.0 |
