# FreeRDP Project FreeRDP vulnerabilities Source: https://junglewise.ai/threats/technologies/freerdp-project-freerdp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/freerdp-project-freerdp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 39 vulnerabilities in FreeRDP Project FreeRDP: 0 in the last 7 days and 39 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121962, was published on 4 November 2026. 39 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 23 - Last 90 days: 39 - All time: 39 (0 critical, 0 exploited in the wild) ## About FreeRDP Project FreeRDP Library implementing the Remote Desktop Protocol for remote desktop access. ## Latest FreeRDP Project FreeRDP vulnerabilities - [CVE-2026-121962: FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in) (high, CVSS 8.1, published 4 Nov 2026) - [CVE-2026-121961: FreeRDP use-after-free in DRDYNVC tracker race condition](https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in) (medium, CVSS 5.9, published 4 Nov 2026) - [CVE-2026-121959: FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in) (medium, CVSS 6.5, published 4 Nov 2026) - [CVE-2026-121951: FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-121402: FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-121399: FreeRDP memory exhaustion in RD Gateway packet handling](https://junglewise.ai/threats/cve-2026-121399-freerdp-before-3-32-2-contains-a-memory-allocation-vulnerability) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-121397: FreeRDP heap buffer over-read in PNG encoding](https://junglewise.ai/threats/cve-2026-121397-freerdp-before-3-32-2-contains-a-heap-buffer-over-read) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-121393: FreeRDP denial of service in RemoteFX region processing](https://junglewise.ai/threats/cve-2026-121393-freerdp-from-3-0-0-before-3-32-2-contains-a-denial-of-service) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-121388: FreeRDP uncontrolled memory allocation in DRDYNVC DATA_FIRST](https://junglewise.ai/threats/cve-2026-121388-freerdp-from-3-0-0-before-3-32-2-contains-an-uncontrolled) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-114046: FreeRDP null-pointer dereference in smartcard emulation](https://junglewise.ai/threats/cve-2026-114046-freerdp-3-0-0-before-3-32-0-contains-a-null-pointer-dereference) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114045: FreeRDP heap buffer overflow in rdpsnd server channel](https://junglewise.ai/threats/cve-2026-114045-freerdp-before-3-32-1-contains-a-heap-based-buffer-overflow-in) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-114043: FreeRDP heap-based out-of-bounds read in WinPR clipboard PNG synthesis](https://junglewise.ai/threats/cve-2026-114043-freerdp-before-3-32-1-contains-a-heap-based-out-of-bounds-read) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114041: FreeRDP heap out-of-bounds read in RD Gateway message handler](https://junglewise.ai/threats/cve-2026-114041-freerdp-before-3-32-1-on-windows-contains-a-heap-out-of-bounds) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-111880: FreeRDP heap out-of-bounds write in NTLM hash-callback](https://junglewise.ai/threats/cve-2026-111880-freerdp-versions-from-2-0-0-before-3-32-0-contain-a-heap-out-of) (high, CVSS 7.4, published 17 Oct 2026) - [CVE-2026-111382: FreeRDP heap out-of-bounds write in AVC444 YUV444 combine](https://junglewise.ai/threats/cve-2026-111382-freerdp-before-3-32-0-contains-a-client-side-heap-out-of-bounds) (high, CVSS 8.8, published 16 Oct 2026) - [CVE-2026-111381: FreeRDP heap buffer overflow in persistent cache v2 parser](https://junglewise.ai/threats/cve-2026-111381-freerdp-before-3-32-0-contains-a-heap-buffer-overflow) (high, CVSS 7.3, published 16 Oct 2026) - [CVE-2026-111379: FreeRDP heap buffer overflow in persistent cache parser](https://junglewise.ai/threats/cve-2026-111379-freerdp-before-3-32-0-contains-a-heap-buffer-overflow) (high, CVSS 7.3, published 16 Oct 2026) - [CVE-2026-111376: FreeRDP heap out-of-bounds read in Windows cliprdr FILECONTENTS_SIZE](https://junglewise.ai/threats/cve-2026-111376-freerdp-from-3-30-0-before-3-32-0-contains-a-heap-out-of-bounds) (medium, CVSS 5, published 16 Oct 2026) - [CVE-2026-111373: FreeRDP NULL pointer dereference in websocket transport](https://junglewise.ai/threats/cve-2026-111373-freerdp-before-3-32-0-contains-a-null-pointer-dereference) (medium, CVSS 5.3, published 16 Oct 2026) - [CVE-2026-110838: FreeRDP shadow input injection before authentication](https://junglewise.ai/threats/cve-2026-110838-freerdp-shadow-server-from-3-0-0-before-3-32-0-dispatches-input) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-110837: FreeRDP heap-based buffer overflow in MP3 audio decoding](https://junglewise.ai/threats/cve-2026-110837-freerdp-2-0-0-before-3-32-0-when-built-with-with-lame-on-and) (high, CVSS 7.1, published 14 Oct 2026) - [CVE-2026-110832: FreeRDP memory exhaustion in DRDYNVC DATA_FIRST](https://junglewise.ai/threats/cve-2026-110832-freerdp-from-2-0-0-before-3-32-0-contains-a-memory-exhaustion) (medium, CVSS 6.5, published 14 Oct 2026) - [CVE-2026-110830: FreeRDP resource exhaustion in serial device handler](https://junglewise.ai/threats/cve-2026-110830-freerdp-before-3-32-0-fails-to-close-prior-serial-handles-in) (medium, CVSS 5.9, published 14 Oct 2026) - [CVE-2026-109950: FreeRDP heap out-of-bounds read in RD Gateway message handling](https://junglewise.ai/threats/cve-2026-109950-freerdp-from-3-0-0-before-3-32-0-contains-a-heap-out-of-bounds) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109947: FreeRDP uncontrolled resource allocation in drive redirection](https://junglewise.ai/threats/cve-2026-109947-freerdp-from-3-20-1-before-3-32-0-contains-an-uncontrolled) (medium, CVSS 6.5, published 13 Oct 2026) ## Most severe FreeRDP Project FreeRDP vulnerabilities - [CVE-2026-111382: FreeRDP heap out-of-bounds write in AVC444 YUV444 combine](https://junglewise.ai/threats/cve-2026-111382-freerdp-before-3-32-0-contains-a-client-side-heap-out-of-bounds) (high, CVSS 8.8, published 16 Oct 2026) - [CVE-2026-109676: FreeRDP use-after-free in smartcard handling](https://junglewise.ai/threats/cve-2026-109676-freerdp-from-3-0-0-beta1-before-3-32-0-contains-a-use-after-free) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-114045: FreeRDP heap buffer overflow in rdpsnd server channel](https://junglewise.ai/threats/cve-2026-114045-freerdp-before-3-32-1-contains-a-heap-based-buffer-overflow-in) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-121962: FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in) (high, CVSS 8.1, published 4 Nov 2026) - [CVE-2026-110838: FreeRDP shadow input injection before authentication](https://junglewise.ai/threats/cve-2026-110838-freerdp-shadow-server-from-3-0-0-before-3-32-0-dispatches-input) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-121951: FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-111880: FreeRDP heap out-of-bounds write in NTLM hash-callback](https://junglewise.ai/threats/cve-2026-111880-freerdp-versions-from-2-0-0-before-3-32-0-contain-a-heap-out-of) (high, CVSS 7.4, published 17 Oct 2026) - [CVE-2026-111381: FreeRDP heap buffer overflow in persistent cache v2 parser](https://junglewise.ai/threats/cve-2026-111381-freerdp-before-3-32-0-contains-a-heap-buffer-overflow) (high, CVSS 7.3, published 16 Oct 2026) - [CVE-2026-111379: FreeRDP heap buffer overflow in persistent cache parser](https://junglewise.ai/threats/cve-2026-111379-freerdp-before-3-32-0-contains-a-heap-buffer-overflow) (high, CVSS 7.3, published 16 Oct 2026) - [CVE-2026-110837: FreeRDP heap-based buffer overflow in MP3 audio decoding](https://junglewise.ai/threats/cve-2026-110837-freerdp-2-0-0-before-3-32-0-when-built-with-with-lame-on-and) (high, CVSS 7.1, published 14 Oct 2026) ## Vulnerabilities per week 39 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 26 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 9 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FreeRDP Project FreeRDP vulnerabilities", https://junglewise.ai/threats/technologies/freerdp-project-freerdp, 13 November 2026.