Executive brief
FreeRDP is a popular open-source Remote Desktop Protocol client and server library used to enable remote desktop access across platforms. Authenticated clients can exploit a buffer handling bug to corrupt heap memory and potentially execute arbitrary code on FreeRDP servers running affected versions. This could allow an attacker to take over a server or access sensitive data transmitted through remote desktop sessions.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) and integer underflow (CWE-191) in the ChannelPduTracker buffer handling for static virtual channels when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. The tracker uses a fixed 1608-byte buffer but does not properly validate incoming channel messages larger than this size; an oversized message causes the offset calculation to underflow on the next read, leading to a heap write that corrupts adjacent heap structures including function pointers. The attack requires an authenticated RDP session and is reachable only in builds compiled with NDEBUG and WITH_VERBOSE_WINPR_ASSERT=OFF (the documented stable-build configuration). The vulnerability affects FreeRDP versions 3.28.0 through 3.30.0 and was fixed in version 3.31.0 by commit 40d9202, which caps and fragments oversized payloads.
Affected products
- FreeRDP FreeRDP 3.28.0 through 3.30.0
Timeline
- 2026-09-15: disclosed
- 2026-09-01: patched: Fix committed to master branch as commit 40d9202; released in version 3.31.0