FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinpr-develUpgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-libs | Apr 20, 2026 | Apr 16, 2026 |
| Alpine Linux | — | Upgrade freerdp | Apr 1, 2026 | Mar 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfo | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinprUpgrade libwinpr-develUpgrade freerdp | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinprUpgrade libwinpr-develUpgrade freerdp-debugsourceNo solution existsUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-devel | Apr 17, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr | Apr 20, 2026 | Apr 18, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3Upgrade freerdp3-x11Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub