FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Aug 20, 2026 | Aug 19, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr | Aug 5, 2026 | Aug 5, 2026 |
| Redhat_linux | — | No solution existsUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfo | Aug 26, 2026 | Aug 19, 2026 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-server | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade freerdp3-x11Upgrade libfreerdp3-3Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub