FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Jul 13, 2026 | Jul 10, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-debuginfo | Aug 10, 2026 | Jul 10, 2026 |
| Redhat_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade libwinprUpgrade freerdpNo solution existsUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-devel | Jul 17, 2026 | Jul 10, 2026 |
| Rocky_linux | — | Upgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp | Aug 7, 2026 | Aug 6, 2026 |
| Ubuntu | — | Upgrade freerdp3-x11Upgrade libfreerdp3-3Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub