Every story tagged Freerdp, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
7 stories · open in the command center
A critical buffer over-disclosure vulnerability (CVSS 9.3) in FreeRDP versions before 3.29.0 allows remote attackers to extract sensitive data including masking keys through malicious WebSocket gateway communications, with potential for denial of service attacks. This vulnerability poses significant risk to any organization using FreeRDP for remote desktop access, particularly in hybrid work and VPN gateway scenarios where gateway WebSocket transport is deployed. IT organizations must immediately assess their FreeRDP deployments and prioritize upgrading to version 3.29.0 or later to prevent potential credential compromise and service disruption.
A high-severity denial-of-service vulnerability (CVSS 8.7) in FreeRDP versions before 3.29.0 allows remote attackers to crash client processes by exploiting null pointer dereference in smartcard cache operations, with no authentication required. This poses significant risk to organizations using FreeRDP for remote desktop access, particularly those with smartcard authentication enabled, requiring immediate inventory and patching efforts. IT organizations must prioritize upgrading to FreeRDP 3.29.0 or later to prevent service disruptions and potential attack surface expansion in hybrid work environments.
A critical heap buffer overflow vulnerability (CVSS 8.7) in FreeRDP versions 3.28.0 and earlier allows unauthenticated remote attackers to crash RDP servers through malicious client connections, posing significant availability risks to organizations relying on RDP for remote access infrastructure. Organizations must immediately inventory FreeRDP deployments and upgrade to version 3.29.0 to prevent potential service disruptions and heap corruption attacks. This vulnerability highlights the need for stronger input validation in critical remote access components and underscores the importance of maintaining current patch levels for foundational connectivity infrastructure.
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
A critical heap buffer overflow vulnerability (CVSS 8.7) has been identified in FreeRDP 3.28.0 that could allow remote attackers to execute arbitrary code through RAIL orderLength underflow exploitation. This poses significant security risks to organizations using FreeRDP for remote desktop access, potentially compromising system integrity and enabling lateral movement across enterprise networks. IT leaders must prioritize patching and security controls around FreeRDP deployments to mitigate exposure to remote code execution attacks.
A critical use-after-free vulnerability (CVE-2026-67300) in FreeRDP versions before 3.29.0 has been identified with a CVSS score of 8.7, posing significant risk to any organization using this remote desktop protocol software for secure access and remote work capabilities. This vulnerability could enable attackers to execute arbitrary code or cause denial of service, potentially compromising remote infrastructure and user systems across your enterprise. IT organizations must immediately assess FreeRDP deployment across their environment and prioritize patching to version 3.29.0 or later to mitigate this high-severity threat.
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.