FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
CVSS Details
- CVSS 4.0 Base Score: 5.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-develUpgrade libwinpr | Feb 27, 2026 | Feb 23, 2026 |
| Alpine Linux | — | Upgrade freerdp | Feb 10, 2026 | Jan 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdpUpgrade freerdp-develUpgrade libwinprUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-libs-debuginfo | Feb 20, 2026 | Jan 14, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libwinprUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-server | Feb 24, 2026 | Jan 14, 2026 |
| Redhat_linux | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade libwinpr-debuginfoNo solution existsUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdp-libs | Feb 24, 2026 | Jan 14, 2026 |
| Rocky_linux | — | Upgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-server | Feb 26, 2026 | Feb 24, 2026 |
| Suse | — | Upgrade freerdp2Upgrade uwac0-0-develUpgrade libfreerdp2-2Upgrade freerdp-waylandUpgrade libfreerdp3-3Upgrade rdtk0-develUpgrade freerdp-sdlUpgrade libfreerdp-server-proxy3-3Upgrade freerdpUpgrade libwinpr2-2Upgrade librdtk0-0Upgrade uwac0-develUpgrade freerdp-proxyUpgrade winpr-develUpgrade freerdp-develUpgrade freerdp-proxy-pluginsUpgrade freerdp2-serverUpgrade libwinpr3-3Upgrade freerdp-serverUpgrade libuwac0-0Upgrade freerdp2-proxyUpgrade freerdp2-develUpgrade winpr2-devel | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Jan 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub