CVE-2026-25941Medium· 4.3▾ TwilightPoC availableFreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that all…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a bitmapDataLength value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
freerdp >= 2.0.0, < 2.11.8freerdp >= 3.0.0, < 3.23.0Upgrade past the affected range:
freerdp 3.23.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121397Medium· 4.3FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()
CVE-2026-114043Medium· 6.5Vulnerability in FreeRDP
CVE-2026-111376Medium· 5.0FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE
CVE-2026-111374Medium· 5.3FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest
CVE-2026-111375Medium· 4.8FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title
CVE-2026-109950Medium· 4.3FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths