A vulnerability was found in FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read in gdi.c.

Upstream Reference:

https://pub.freerdp.com/cve/CVE-2020-11522/

Upstream Commit:

https://github.com/FreeRDP/FreeRDP/commit/907640a924fa7a9a99c80a48ac225e9d8e41548b

Last updated 25 August 2025

A vulnerability was found in FreeRDP after 1.1 and before 2.0.0, there is a Stream pointer out of bounds in updaterecvsecondaryorder could lead out of bounds read later

Upstream Reference:

https://pub.freerdp.com/cve/CVE-2020-11526/

Upstream Commit:

https://github.com/FreeRDP/FreeRDP/commit/192856cb59974ee4d7d3e72cbeafa676aa7565cf

Last updated 25 August 2025

Last updated 25 August 2025

A vulnerability was found in FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read in bitmap.c.

Upstream Reference:

https://pub.freerdp.com/cve/CVE-2020-11525/

Upstream Commit:

https://github.com/FreeRDP/FreeRDP/commit/0b6b92a25a77d533b8a92d6acc840a81e103684e

Last updated 24 July 2024

FreeRDP 2.0.0-rc3 contains an out of bounds read vulnerability in drdynvcprocesscapabilityrequest function in channels/drdynvc/client/drdynvcmain.c file. To exploit this RDPClient must connect to the rdp server with the echo option. This can lead to a two-byte outbound reading from the client memory.

References: https://github.com/FreeRDP/FreeRDP/issues/4866

Upstream Patch: https://github.com/FreeRDP/FreeRDP/pull/4871/commits/baee520e3dd9be6511c45a14c5f5e77784de1471