FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp | Oct 11, 2026 | Sep 10, 2026 |
| Alpine Linux | — | Upgrade freerdp | Aug 20, 2026 | Aug 19, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp | Aug 5, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade freerdpUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-develNo solution existsUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfo | Aug 26, 2026 | Aug 19, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-libs | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade freerdp-x11Upgrade libfreerdp3-3Upgrade freerdp3-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub