PT-2026-57293 · Freerdp · Freerdp

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-57156

NVD

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update read delta points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

Fix

Heap Based Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-122

CWE-190

Related Identifiers

CVE-2026-57156

Affected Products

Freerdp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-57156 · Security Note
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 · Note
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7 · Note
• https://github.com/FreeRDP/FreeRDP/pull/12938 · Note
• https://github.com/FreeRDP/FreeRDP/commit/487f35daccb36a6224e530dcd8fa60850825f823 · Note