Debian Freerdp2 vulnerabilities

CVE-2023-40589 [MEDIUM] CVE-2023-40589: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ... FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-

CVE-2026-33982 [HIGH] CVE-2026-33982: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2. Scope: local bookworm: open bullseye: open

CVE-2023-39354 [MEDIUM] CVE-2023-39354: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ... FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to lev

CVE-2026-25954 [MEDIUM] CVE-2026-25954: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channe

CVE-2026-26986 [MEDIUM] CVE-2026-26986: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer th

CVE-2026-31884 [MEDIUM] CVE-2026-31884: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on

CVE-2023-39351 [MEDIUM] CVE-2023-39351: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ... FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the

CVE-2018-8789 [HIGH] CVE-2018-8789: freerdp2 - FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the N... FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Service (segfault). Scope: local bookworm: resolved (fixed in 2.0.0~git20181120.1.e21b72c95+dfsg1-1) bullseye: resolved (fixed in 2.0.0~git20181120.1.e21b72c95+dfsg1-1)

CVE-2020-4031 [LOW] CVE-2020-4031: freerdp2 - In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. ... In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. Scope: local bookworm: resolved (fixed in 2.1.2+dfsg1-1) bullseye: resolved (fixed in 2.1.2+dfsg1-1)

CVE-2019-17177 [HIGH] CVE-2019-17177: freerdp2 - libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has... libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value. Scope: local bookworm: resolved (fixed in 2.0.0~git20190204.1.2693389a+dfsg1-2) bullseye: resolved (fixed in 2.0.0~git20190204.1.2693389a+dfsg1-2)

CVE-2020-13396 [HIGH] CVE-2020-13396: freerdp2 - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vul... An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2018-1000852 [MEDIUM] CVE-2018-1000852: freerdp2 - FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5b... FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server wi

CVE-2020-11524 [MEDIUM] CVE-2020-11524: freerdp2 - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has a... libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2019-17178 [HIGH] CVE-2019-17178: freerdp2 - HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as u... HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value. Scope: local bookworm: resolved (fixed in 2.0.0~git20190204.1.2693389a+dfsg1-2) bullseye: resolved (fixed in 2.

CVE-2020-11521 [MEDIUM] CVE-2020-11521: freerdp2 - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-... libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2026-33977 [MEDIUM] CVE-2026-33977: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASS

CVE-2026-33985 [MEDIUM] CVE-2026-33985: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2. Scope: local bookworm: open bullseye: open

CVE-2026-27015 [MEDIUM] CVE-2026-27015: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` → `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSER

CVE-2026-33983 [MEDIUM] CVE-2026-33983: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU D

CVE-2026-33952 [MEDIUM] CVE-2026-33952: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecti