FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This issue has been patched in version 3.24.2.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Apr 1, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-develUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-server | May 13, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinprNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-develUpgrade freerdp-server-debuginfo | May 12, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-devel | May 15, 2026 | May 13, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3Upgrade freerdp-x11Upgrade freerdp3-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub