PT-2026-25333 · Freerdp+1 · Freerdp+1

Ehdgks0627 · Published 2026-01-01 · Updated 2026-05-12 · CVE-2026-29775

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A client-side heap out-of-bounds read/write issue exists in FreeRDP's bitmap cache subsystem. This is due to an incorrect boundary check in the bitmap cache put function when handling a CACHE BITMAP ORDER (Rev1) message with a cacheId equal to maxCells. This allows a malicious server to bypass security checks and access memory outside the allocated array.

Recommendations Update to version 3.24.0 or later.

Exploit

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

ALSA-2026:16014

ALSA-2026:16019

ALSA-2026:16482

BDU:2026-04139

CVE-2026-29775

GHSA-H666-RFW3-JHVJ

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

SUSE-SU-2026:21436-1

Affected Products

Freerdp

Rocky Linux

References · 70

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29775.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f · Patch
• https://osv.dev/vulnerability/ALSA-2026:16019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29775 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-16019.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-29775 · Security Note
• https://bdu.fstec.ru/vul/2026-04139 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-29775 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-16482.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29775 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:16482 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29775 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:16014 · Vendor Advisory