FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Aug 20, 2026 | Aug 19, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdpUpgrade libwinpr | Aug 5, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-devel | Aug 24, 2026 | Aug 19, 2026 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-devel | Sep 2, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3-x11Upgrade freerdp-x11Upgrade libfreerdp3-3 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub