FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
CVSS Details
- CVSS 4.0 Base Score: 5.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade libwinpr-develUpgrade freerdp | Feb 27, 2026 | Feb 23, 2026 |
| Alpine Linux | — | Upgrade freerdp | Feb 10, 2026 | Jan 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdp-develUpgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade libwinpr-debuginfo | Feb 20, 2026 | Jan 14, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdpUpgrade libwinpr | Feb 24, 2026 | Jan 14, 2026 |
| Redhat_linux | — | Upgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develNo solution existsUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr | Feb 24, 2026 | Jan 14, 2026 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-devel | Feb 26, 2026 | Feb 24, 2026 |
| Suse | — | Upgrade uwac0-0-develUpgrade freerdp-sdlUpgrade freerdp2Upgrade freerdp-proxyUpgrade libfreerdp3-3Upgrade rdtk0-develUpgrade libfreerdp-server-proxy3-3Upgrade libfreerdp2-2Upgrade winpr-develUpgrade freerdp-waylandUpgrade uwac0-develUpgrade librdtk0-0Upgrade libwinpr2-2Upgrade freerdpUpgrade freerdp-develUpgrade freerdp2-serverUpgrade freerdp2-proxyUpgrade libuwac0-0Upgrade libwinpr3-3Upgrade freerdp-serverUpgrade winpr2-develUpgrade freerdp-proxy-pluginsUpgrade freerdp2-devel | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Jan 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub