FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-libs-debuginfo | Aug 10, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdp | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub