Debian Freerdp2 vulnerabilities

CVE-2026-24682 [HIGH] CVE-2026-24682: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2026-27950 [HIGH] CVE-2026-27950: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the poi

CVE-2026-29775 [MEDIUM] CVE-2026-29775: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one eleme

CVE-2026-23948 [MEDIUM] CVE-2026-23948: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: ope

CVE-2026-24684 [HIGH] CVE-2026-24684: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2026-24683 [HIGH] CVE-2026-24683: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_inp... FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: op

CVE-2022-39282 [LOW] CVE-2022-39282: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based cli... FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do no

CVE-2024-32661 [HIGH] CVE-2024-32661: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based c... FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Scope: local bookworm: resolved (fixed in 2.11.7+dfsg1-6~deb12u1) bullseye: resolved (fixed in 2.3.0+dfsg1-2+deb11u2)

CVE-2026-24675 [HIGH] CVE-2026-24675: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2026-24491 [HIGH] CVE-2026-24491: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2026-27951 [MEDIUM] CVE-2026-27951: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23

CVE-2026-33986 [HIGH] CVE-2026-33986: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2

CVE-2026-25941 [MEDIUM] CVE-2026-25941: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the... FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength

CVE-2026-24681 [HIGH] CVE-2026-24681: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2026-24680 [HIGH] CVE-2026-24680: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open

CVE-2023-39350 [MEDIUM] CVE-2023-39350: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ... FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading

CVE-2022-39283 [MEDIUM] CVE-2022-39283: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based... FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switc

CVE-2026-25942 [MEDIUM] CVE-2026-25942: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Vers

CVE-2024-32660 [HIGH] CVE-2024-32660: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Scope: local bookworm: resolved (fixed in 2.11.7+dfsg1-6~deb12u1) bullseye: resolved (fixed in 2.3.0+dfsg1-

CVE-2026-24676 [HIGH] CVE-2026-24676: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0. Scope: local bookworm: open bullseye: open