FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
CVSS Details
- CVSS 4.0 Base Score: 5.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-libs | Feb 27, 2026 | Feb 23, 2026 |
| Alpine Linux | — | Upgrade freerdp | Feb 10, 2026 | Jan 14, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-serverUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp | Feb 20, 2026 | Jan 14, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-serverUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp | Feb 24, 2026 | Jan 14, 2026 |
| Redhat_linux | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsNo solution existsUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade freerdp-devel | Feb 24, 2026 | Jan 14, 2026 |
| Rocky_linux | — | Upgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfo | Feb 26, 2026 | Feb 24, 2026 |
| Suse | — | Upgrade libuwac0-0Upgrade freerdp-develUpgrade uwac0-develUpgrade winpr-develUpgrade freerdp-serverUpgrade freerdp-waylandUpgrade freerdpUpgrade freerdp-proxy-pluginsUpgrade freerdp-sdlUpgrade libfreerdp-server-proxy3-3Upgrade libwinpr3-3Upgrade rdtk0-develUpgrade libfreerdp3-3Upgrade freerdp-proxyUpgrade librdtk0-0 | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Jan 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub