FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in…

FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index

FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write

libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write

libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow

libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

Vulnerability in FreeRDP

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type

FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST

FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment

FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard

FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read

FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width

FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle

FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order

FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet

FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response

FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order

FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update

FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username

FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA

FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName

FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU

FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

FreeRDP before 3.31.0 Denial of Service via URBDRC

FreeRDP before 3.31.0 Integer Overflow Double Free

FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

FreeRDP before 3.31.0 Denial of Service via pool_decode_rect

FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc

FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound

FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR

FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

FreeRDP: Denial of service through ADPCM frame size calculation