GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OESA-2026-2040 (CVE-2026-26955)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
freerdp security update
Details

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., xfreerdp) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The gdi_SurfaceCommand_ClearCodec() handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled cmd->left/cmd->top (and subcodec rectangle offsets) to reach image copy routines that write into surface->data without bounds enforcement. The OOB write corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and corruption of codecs* is sufficient to reach an indirect function pointer call (NSC_CONTEXT.decode at nsc.c:500) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.(CVE-2026-31885)

FreeRDP is an open-source Remote Desktop Protocol (RDP) client. An integer underflow vulnerability exists in the implementation of its Progressive codec. By sending a specially crafted RDP packet, an attacker can trigger an underflow of a BYTE (unsigned 8-bit integer) variable, leading to undefined behavior (UB). This may cause the application to crash or enter an infinite loop, consuming excessive CPU resources and resulting in a denial-of-service (DoS) condition. The vulnerability stems from insufficient boundary checks on input data.(CVE-2026-33983)

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client. A heap out-of-bounds write vulnerability exists in the resize_vbar_entry() function of its ClearCodec component when processing specific video data. An attacker can craft a malicious RDP packet to trigger this vulnerability, potentially leading to remote code execution or service crash.(CVE-2026-33984)

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "freerdp-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-devel-2.11.8-3.oe2403sp1.aarch64.rpm",
          "freerdp-help-2.11.8-3.oe2403sp1.aarch64.rpm",
          "libwinpr-2.11.8-3.oe2403sp1.aarch64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "freerdp-2.11.8-3.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "freerdp-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-debuginfo-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-debugsource-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-devel-2.11.8-3.oe2403sp1.x86_64.rpm",
          "freerdp-help-2.11.8-3.oe2403sp1.x86_64.rpm",
          "libwinpr-2.11.8-3.oe2403sp1.x86_64.rpm",
          "libwinpr-devel-2.11.8-3.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "freerdp",
        "purl": "pkg:rpm/openEuler/freerdp\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.8-3.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026amp;apos;s open specifications. This package provides the client applications xfreerdp.\r\n\r\nSecurity Fix(es):\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd-\u0026gt;left`/`cmd-\u0026gt;top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface-\u0026gt;data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct\u0026apos;s `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command \u2014 full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.(CVE-2026-26955)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar-\u0026gt;pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and  on the brk heap (desktop \u2264 128\u00d7128), an adjacent `NSC_CONTEXT` struct\u0026apos;s `decode` function pointer is overwritten with attacker-controlled pixel data \u2014 control-flow\u2013relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc-\u0026gt;decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.(CVE-2026-26965)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0,  the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.(CVE-2026-31806)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size \u0026gt; 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.(CVE-2026-31883)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.(CVE-2026-31885)\n\nFreeRDP is an open-source Remote Desktop Protocol (RDP) client. An integer underflow vulnerability exists in the implementation of its Progressive codec. By sending a specially crafted RDP packet, an attacker can trigger an underflow of a BYTE (unsigned 8-bit integer) variable, leading to undefined behavior (UB). This may cause the application to crash or enter an infinite loop, consuming excessive CPU resources and resulting in a denial-of-service (DoS) condition. The vulnerability stems from insufficient boundary checks on input data.(CVE-2026-33983)\n\nFreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client. A heap out-of-bounds write vulnerability exists in the `resize_vbar_entry()` function of its ClearCodec component when processing specific video data. An attacker can craft a malicious RDP packet to trigger this vulnerability, potentially leading to remote code execution or service crash.(CVE-2026-33984)",
  "id": "OESA-2026-2040",
  "modified": "2026-08-06T11:11:02Z",
  "published": "2026-04-25T11:11:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2040"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26955"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26965"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31806"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31883"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31885"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33983"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33984"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "freerdp security update",
  "upstream": [
    "CVE-2026-26955",
    "CVE-2026-26965",
    "CVE-2026-31806",
    "CVE-2026-31883",
    "CVE-2026-31885",
    "CVE-2026-33983",
    "CVE-2026-33984"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.