FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
CVSS Details
- CVSS 4.0 Base Score: 7.1 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-server | Sep 30, 2026 | Sep 15, 2026 |
| Redhat_linux | — | No solution existsUpgrade freerdp-debugsourceUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade libwinpr | Sep 17, 2026 | Sep 15, 2026 |
| Rocky_linux | — | Upgrade freerdpUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-debuginfo | Oct 8, 2026 | Oct 7, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Sep 22, 2026 | Sep 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub