FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Aug 20, 2026 | Aug 19, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-devel | Aug 5, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-debugsourceNo solution existsUpgrade freerdp-serverUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp | Aug 26, 2026 | Aug 19, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-devel | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade freerdp-x11Upgrade libfreerdp3-3Upgrade freerdp3-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub