FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
CVSS Details
- CVSS 4.0 Base Score: 5.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdp-libs | Feb 27, 2026 | Feb 23, 2026 |
| Alpine Linux | — | Upgrade freerdp | Feb 10, 2026 | Jan 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade libwinpr-devel | Feb 20, 2026 | Jan 14, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade libwinpr-devel | Feb 24, 2026 | Jan 14, 2026 |
| Redhat_linux | — | Upgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-libsNo solution existsUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-server | Feb 24, 2026 | Jan 14, 2026 |
| Rocky_linux | — | Upgrade freerdp-server-debuginfoUpgrade freerdpUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-libs | Feb 26, 2026 | Feb 24, 2026 |
| Suse | — | Upgrade freerdp-serverUpgrade freerdp-proxy-pluginsUpgrade libuwac0-0Upgrade freerdp2-serverUpgrade freerdp-develUpgrade libfreerdp3-3Upgrade libwinpr2-2Upgrade rdtk0-develUpgrade freerdp2-develUpgrade freerdp-sdlUpgrade freerdp-proxyUpgrade winpr2-develUpgrade uwac0-develUpgrade freerdpUpgrade librdtk0-0Upgrade winpr-develUpgrade freerdp2Upgrade libwinpr3-3Upgrade libfreerdp2-2Upgrade libfreerdp-server-proxy3-3Upgrade uwac0-0-develUpgrade freerdp2-proxyUpgrade freerdp-wayland | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Jan 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub