CVE-2026-57156: FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in updatereaddeltapoints in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTAPOINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
freerdpto a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57156?
The severity of CVE-2026-57156 is classified as high with a score of 8.6.
How do I fix CVE-2026-57156?
To fix CVE-2026-57156, upgrade FreeRDP to version 3.28.0 or later on 32-bit builds.
What type of vulnerability is CVE-2026-57156?
CVE-2026-57156 is an integer overflow vulnerability leading to a heap buffer overflow.
Which software is affected by CVE-2026-57156?
CVE-2026-57156 affects the FreeRDP software prior to version 3.28.0 on 32-bit builds.
What are the potential consequences of CVE-2026-57156?
Exploitation of CVE-2026-57156 can lead to remote code execution due to a heap buffer overflow.