FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libsUpgrade libwinpr | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs | Jun 23, 2026 | May 29, 2026 |
| Redhat_linux | — | Upgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-debuginfoNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfo | Jul 9, 2026 | May 29, 2026 |
| Rocky_linux | — | Upgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsource | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3Upgrade freerdp-x11Upgrade freerdp3-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub