CVE-2026-27951
published 2026-02-25CVE-2026-27951: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.40%
34.4th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.23.0+dfsg-1 (forky) | freerdp3 3.23.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.23.0+dfsg-1 (forky) | freerdp3 3.23.0+dfsg-1 (forky) |
| freerdp | freerdp | < 3.23.0 | 3.23.0 |
| ubuntu | freerdp3 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-07-20
CVE-2026-33995 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-03-18
CVE-2026-25954 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled certain RDP packets. A
remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
vendor_redhat·2026-02-25·CVSS 5.3
CVE-2026-27951 [MEDIUM] CWE-190 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The `Stream_EnsureCapacity` function can create an endless blocking loop, leading to a Denial of Service (DoS). This vulnerability can be exploited on 32-bit systems where the available physical memory is g
Debian
CVE-2026-27951: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
vendor_debian·2026·CVSS 5.3
CVE-2026-27951 [MEDIUM] CVE-2026-27951: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Scope: local
bookworm: open
bullseye: open
VulDB
FreeRDP up to 3.22.x Stream_EnsureCapacity integer overflow (GHSA-qcfc-ghxr-h927 / Nessus ID 300278)
vuldb·2026-05-14·CVSS 7.5
CVE-2026-27951 [HIGH] FreeRDP up to 3.22.x Stream_EnsureCapacity integer overflow (GHSA-qcfc-ghxr-h927 / Nessus ID 300278)
A vulnerability identified as problematic has been detected in FreeRDP up to 3.22.x. This impacts the function Stream_EnsureCapacity. Performing a manipulation results in integer overflow.
This vulnerability is known as CVE-2026-27951. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
OSV
CVE-2026-27951: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
bugzilla·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently ma
Bugzilla
CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
bugzilla·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug is already fixed in a published Bodhi update.
---
FEDORA-2026-53fe996a57 (freerdp-3.23.0-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-53fe996a57
Bugzilla
CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
bugzilla·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
CVE-2026-27951 freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:16019 https://access.redhat.com/errata/RHSA-2026:16019
Bugzilla
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-43]
bugzilla·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-43]
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-1c0deda1e7 (freerdp2-2.11.7-16.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-1c0deda1e7
---
FEDORA-2026-1c0deda1e7 (freerdp2-2.11.7-16.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.
---
FEDORA-2026-20b7d49f70 (freerdp2-2.11.7-16.fc45) has been submitted as an update to Fedora 45.
https://bo
Bugzilla
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [epel-all]
bugzilla·2026-02-25·CVSS 7.5
CVE-2026-27951 [HIGH] CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [epel-all]
CVE-2026-27951 freerdp2: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-EPEL-2026-1c4570b861 (freerdp2-2.11.7-7.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1c4570b861
---
FEDORA-EPEL-2026-aa30a19f4c has been pushed to the Fedora EPEL 10.3 testing repository.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-aa30a19f4c
See also https://fedoraproject.org/wiki/QA:Updates_Testing f
Wiz
CVE-2026-27951 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-27951 [MEDIUM] CVE-2026-27951 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27951 :
NixOS vulnerability analysis and mitigation
Stream_EnsureCapacity
FreeRDP
>= SIZE_MAX
Source : NVD
## 7.5
Score
Published February 25, 2026
Severity HIGH
CNA Score 5.3
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
freerdp3
freerdp-libs
Sources
NVD
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22 Severity HIGH No Fix Added at: Mar 02, 2026
Chainguard Has Fix Added at: Mar 02, 2026
Debian 11 Severity HIGH No Fix Added at: Mar 02, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 02, 2026
Debian 14 Severity
2026-02-25
Published