Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-10T19:52:25 FreeRDP: FreeRDP: Arbitrary code execution or denial of service via integer overflow in RDP message processing 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-787

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

A flaw was found in FreeRDP clients. A remote attacker, acting as a malicious Remote Desktop Protocol (RDP) peer, could exploit an integer overflow vulnerability. This overflow occurs when the client processes a specially crafted RDP message, leading to the allocation of an undersized memory buffer. Consequently, the client attempts to write data beyond the boundaries of this buffer, which can result in arbitrary code execution or a denial of service.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Affected freerdp Red Hat Enterprise Linux 9 Affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-57156 https://nvd.nist.gov/vuln/detail/CVE-2026-57156 https://github.com/FreeRDP/FreeRDP/commit/487f35daccb36a6224e530dcd8fa60850825f823 https://github.com/FreeRDP/FreeRDP/pull/12938 https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7