Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-57156FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing

High 8.6

In plain English

A high-severity heap buffer overflow in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.7%top 46.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24freerdp3.29.0-r0ALPINE-CVE-2026-57156
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-57156
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-57156
Debian:14freerdp33.28.0+dfsg-1DEBIAN-CVE-2026-57156
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-57156
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1USN-8561-1
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-57156
Ubuntu:25.10freerdp3no fix listedUBUNTU-CVE-2026-57156
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1USN-8561-1
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-57156

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.28.0

Weakness: CWE-122, CWE-190 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References