CVE-2026-57156 | THREATINT

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

PUBLISHED Reserved 2026-06-24 | Published 2026-07-10 | Updated 2026-07-13 | Assigner GitHub_M

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-122: Heap-based Buffer Overflow

CWE-190: Integer Overflow or Wraparound

Product status

< 3.28.0

affected

References

github.com/...reeRDP/security/advisories/GHSA-v5wf-j8j4-77h7 exploit

github.com/...reeRDP/security/advisories/GHSA-v5wf-j8j4-77h7

github.com/FreeRDP/FreeRDP/pull/12938

github.com/...ommit/487f35daccb36a6224e530dcd8fa60850825f823

github.com/FreeRDP/FreeRDP/releases/tag/3.28.0

cve.org (CVE-2026-57156)

nvd.nist.gov (CVE-2026-57156)

Download JSON