CVE-2026-29775
published 2026-03-13CVE-2026-29775: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache…
PriorityP344high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.32%
24.8th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| freerdp | freerdp | < 3.24.0 | 3.24.0 |
| ubuntu | freerdp3 | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
osv8.2HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-07-20
CVE-2026-33995 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
vendor_redhat·2026-03-13·CVSS 5.3
CVE-2026-29775 [MEDIUM] CWE-787 freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equ
Debian
CVE-2026-29775: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
vendor_debian·2026·CVSS 5.3
CVE-2026-29775 [MEDIUM] CVE-2026-29775: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Scope: local
bookworm: open
bullseye: open
OSV
CVE-2026-29775: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-03-13·CVSS 8.2
CVE-2026-29775 [HIGH] CVE-2026-29775: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [fedora-all]
bugzilla·2026-03-13·CVSS 8.2
CVE-2026-29775 [HIGH] CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [fedora-all]
CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-29775 freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
bugzilla·2026-03-13·CVSS 8.2
CVE-2026-29775 [HIGH] CVE-2026-29775 freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
CVE-2026-29775 freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:16014 https://access.redhat.com/errata/RHSA-2026:16014
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-
Bugzilla
CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [epel-all]
bugzilla·2026-03-13·CVSS 8.2
CVE-2026-29775 [HIGH] CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [epel-all]
CVE-2026-29775 freerdp2: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-EPEL-2026-1c4570b861 (freerdp2-2.11.7-7.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1c4570b861
---
FEDORA-EPEL-2026-aa30a19f4c has been pushed to the Fedora EPEL 10.3 testing repository.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-aa30a19f4c
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more
Wiz
CVE-2026-29775 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-29775 [MEDIUM] CVE-2026-29775 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-29775 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Source : NVD
## 8.2
Score
Published March 13, 2026
Severity HIGH
CNA Score 5.3
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.3
Exploitation Probability (EP
2026-03-13
Published