FreeRDP 3.28.0 Multiple Vulnerability Fixes (RCE/Info Disclosure)

Vulnerability Overview Multiple security vulnerabilities were identified in FreeRDP version 3.28.0, primarily affecting various components on both the client and server sides. These vulnerabilities could lead to issues such as information disclosure and remote code execution. Scope of Impact iOS Client: Patched by @bho3538. Android Client: Updated by @smclibrahim. Windows Client: Updated by @zorjen122. Server-side Smartcard API: Updated by @joantole. Client Statistics Interface: Now supports static channels. Fuzzing and Unit Tests: Improvements made. CMake Preset Support: Simplified creation of out-of-tree build configurations. Remediation 1. CVE-2026-57158: Patched by @hextheshadow. 2. CVE-2026-57157: Patched by Owais Lone. 3. CVE-2026-57156: Patched by @HEXER365. Specific Vulnerability Details GHSA-gjpx-v446-x7fc: Reported by Claude and Ada Logics. GHSA-9g22-w2qr-vcnp: Reported by Claude and Ada Logics. GHSA-127x-hn8-j9hc: Reported by Claude and Ada Logics. GHSA-72j9-356v-88xg: Reported by Claude and Ada Logics. GHSA-v64m-xdxf-hnv6: Reported by @rahulhoysala. GHSA-mq3f-59pg-c5pp: Reported by @hextheshadow. GHSA-47fb-jw86-c3j: Reported by Owais Lone. GHSA-v5df-j84-77h7: Reported by @HEXER365. Security Updates GHSA-rq8f-9xjh-pr3m: Security updates applied. Other Changes iOS Client: Modernization efforts; removal of some deprecation warnings. Android Client: Added OpenH264 build; support for riscv64; made release configurable; allowed overriding version name and code; redesigned touch pointer; moved external dependencies to separate CMake files. Android Build: Protected file clipboard. SDL: Skipped Askpass; threw real exceptions instead of invalid naked throws; ran on the SDL thread; fixed issue where mouse and touchpad natural scroll settings were ignored. Windows Client: Reset scroll offset when hiding scrollbars; improved wfreerdp fullscreen floating controls. Channel Statistics: Added . Support: Added support for RDPRDP device control response. Wlog Attacher Context. winpr.image: Bound unaligned bitmap reads to declared image size. codec.color: Added null checks for copying. Win cresize: Adjusted Windows build with MSVC. Channel Statistics and Random Gateway Connection ID. Channel Video: Bound frame copy to current surface size. OSS-Fuzz: Added new fuzzing target for channel track client. utils.smartcard: Verified against size during unpack. Channel rdpsec: Fixed device add notification parsing. emu.scad: Bound selection-by-AID comparison to GIDS AID length. Rails Feature Settings: xfreerdp keyboard sync. Core Orders: Fixed overflow protection in . codec.mppc: Added missing bounds checks. Channel tsmf: Bound visible rectangle read in . Channel rdpsec: Bound channel name read in device removal PDU. Core TCP: Improved connection failure logging. Warning Fixes. codec.plane: Fixed range check; early abort. Channel rdpsnd.m4ac: Restored audio after AVAudioEngine configuration changes. codec.plane: Performed range check before reading control byte in plane frames. Channel rail: Fixed tests and uninitialized variables. Channel rdpdr: Fixed off-by-one scan length in . Channel remdesk: Validated CAL PDU DataLength against received stream. Channel rdpsnd: Bound client format PDU length to UINT16. WinPR Hard Parser Checks. winpr.file: Bound "?" wildcard match to filename length. Channel urbdrc: Bound MS USB descriptor read to received length. Core Update: Fixed calling convention for Windows x86. Channel drive: Denied trailing ".." containing ".dotdb". OSS-Fuzz: Added new fuzzing target for WinPR Clipboard handling. Pvr12970. Clipdr and rdpsnd Fixes. Channel rail: Fixed order read cleanup. Core TLS: Skipped AuthenticateEx for RDPTLS/SMARTCARD_PIN/FIDO_PIN. Replaced NULL with nullptr. Channel clipdr: Fixed PDU-tracker leak. Fuzzing BMP. Core Gateway: Fixed const warnings. Channel: Bound dynamic channel header to received length. CMake: Added minimal preset for lightweight builds. Cleaned up all. Range checks. Deprecations. winpr.string: Fixed winpr_strnstr needle length (Gateway SIGSEGV). BMP Cache. codec.dsp: Ensured capacity in Opus encoding. winpr.string: Matched winpr_strnstr fallback to native strnstr. Smartcard Fixes. Client Common: Passed PEM directly for smartcard-logon. Correct UTF-8 to UTF-16 length. New Contributors @aldr @arthurscchan @TBX3D @rohitkuma1313 @kunimart @apocelipes @bho3538 @insaf021 @insaf021 @kapott Full Changelog For the complete detailed changelog, run from the previous release: Contributors kapott, aldr, and 13 other contributors Assets None Discussions 0 comments --- This is a concise summary of the security vulnerabilities in FreeRDP version 3.28.0.

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP 3.28.0 Multiple Vulnerability Fixes (RCE/Info Disclosure)

More from this source