Skip to content
COOEY

FAIL › dossier

freerdp

VENDOR

· dossier confidence 50%

FreeRDP is an open-source RDP client with a critical security posture marked by a high frequency of severe memory corruption and RCE vulnerabilities in its graphics and bitmap decoding components.

Failure events
20
Zero-days
0
RCEs
5
On KEV
0
Critical
20
Worst shame
85
PROFILE
Categoryopen-source softwareWhat they doFreeRDP is a free implementation of the Remote Desktop Protocol (RDP) used for remote desktop connections.
SECURITY POSTURE

The project has a severe track record of critical vulnerabilities, particularly in its GFX pipeline and bitmap decoders, with multiple RCEs and memory corruption flaws discovered in rapid succession across 2026.

Notable failures
  • CVE-2026-57158 RCE via GFX pipeline buffer overflow
  • CVE-2026-57156 integer overflow in update_read_delta_points
  • CVE-2026-45700 out-of-bounds heap write in planar bitmap decoder
Patterns: repeated critical RCEs and memory corruption in GFX/bitmap pipelines; multiple critical flaws discovered within narrow version windows
FAILURE HISTORY · 40
DATEEVENTSEVSUMMARY
2026-08-19 CVE-2026-55194 critical FreeRDP's heap corruption flaw in response reassembly allows remote code execution via malicious RDP traffic.
2026-08-19 CVE-2026-55194 critical FreeRDP's heap corruption flaw in response reassembly allows remote code execution via malicious RDP traffic.
2026-08-19 CVE-2026-55191 critical A malicious RDP server can exploit a heap corruption flaw in FreeRDP's H.264 decoder to crash the client and execute arbitrary code.
2026-08-19 CVE-2026-55191 critical A malicious RDP server can exploit a heap corruption flaw in FreeRDP's H.264 decoder to crash the client and execute arbitrary code.
2026-08-11 CVE-2026-73242 critical CVE-2026-73242 in FreeRDP allows remote code execution via out-of-bounds reads/writes during Kerberos decryption in FreeRDP versions prior to 3.30.0.
2026-08-11 CVE-2026-73242 critical CVE-2026-73242 in FreeRDP allows remote code execution via out-of-bounds reads/writes during Kerberos decryption in FreeRDP versions prior to 3.30.0.
2026-08-19 CVE-2026-63633 critical A malicious RDP server exploiting a heap corruption flaw in FreeRDP can crash the client and potentially execute arbitrary code.
2026-08-19 CVE-2026-63633 critical A malicious RDP server exploiting a heap corruption flaw in FreeRDP can crash the client and potentially execute arbitrary code.
2026-07-10 CVE-2026-57158 critical FreeRDP clients using the GFX pipeline before version 3.28.0 are vulnerable to a buffer overflow that allows remote code execution via truncated RDP payloads.
2026-07-10 CVE-2026-57158 critical FreeRDP clients using the GFX pipeline before version 3.28.0 are vulnerable to a buffer overflow that allows remote code execution via truncated RDP payloads.
2026-07-10 CVE-2026-57156 critical FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allow
2026-07-10 CVE-2026-57156 critical FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allow
2026-05-29 CVE-2026-45700 critical FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate
2026-05-29 CVE-2026-45700 critical FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate
2026-03-13 CVE-2026-31806 critical CVE-2026-31806: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0
2026-03-13 CVE-2026-31806 critical CVE-2026-31806: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0
2026-01-19 CVE-2026-23530 critical CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23531 critical CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23531 critical CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23884 critical CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23884 critical CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23532 critical CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23532 critical CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23883 critical CVE-2026-23883: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23883 critical CVE-2026-23883: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23534 critical CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23534 critical CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23533 critical CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23533 critical CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-19 CVE-2026-23530 critical CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2026-01-14 CVE-2026-22855 critical CVE-2026-22855: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22855 critical CVE-2026-22855: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22858 critical CVE-2026-22858: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22858 critical CVE-2026-22858: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22859 critical CVE-2026-22859: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22859 critical CVE-2026-22859: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22853 critical CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2026-01-14 CVE-2026-22853 critical CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
2025-12-17 CVE-2025-68118 critical CVE-2025-68118: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
2025-12-17 CVE-2025-68118 critical CVE-2025-68118: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-12 18:00:52.188620+00:00