FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-develUpgrade libwinpr-develUpgrade libwinprUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-debuginfo | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-debuginfo | Jun 23, 2026 | May 26, 2026 |
| Redhat_linux | — | Upgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-debuginfoNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-devel | Jul 9, 2026 | May 26, 2026 |
| Rocky_linux | — | Upgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-devel | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade freerdp-x11Upgrade freerdp3-x11Upgrade libfreerdp3-3 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub