Executive brief
FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. In 32-bit versions of the software, a flaw allows a malicious remote server to send specially crafted data that causes the client to crash or potentially allow the attacker to run unauthorized code on the user's machine. This could lead to a total compromise of the user's workstation or a disruption of remote work operations.
Technical details
An integer overflow exists in `update_read_delta_points` within `libfreerdp/core/orders.c` on 32-bit builds where `SIZE_MAX` is 32 bits. The vulnerability occurs when a network-controlled point count is multiplied by `sizeof(DELTA_POINT)` during memory allocation and initialization. Because the overflow guard was incorrectly implemented (inverted), a large attacker-supplied value can result in a small heap allocation followed by a large `ZeroMemory` or write operation. This leads to a heap-based buffer overflow. An attacker acting as a malicious RDP server can exploit this when a client connects and processes PolyLine or PolyGon orders. The issue is fixed in version 3.28.0 by correcting the overflow check logic.
Affected products
- FreeRDP FreeRDP < 3.28.0 (32-bit builds)
Timeline
- 2026-06-20: other: Initial patch submitted via pull request
- 2026-07-06: patched: Version 3.28.0 released
- 2026-07-06: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE-2026-57156 published to NVD