FreeRDP hat einen Integer Underflow in der Funktion update_read_cache_bitmap_order der FreeRDP Core Library

An attacker could exploit this integer underflow to crash the FreeRDP client or server, resulting in a denial-of-service. Successful exploitation requires the attacker to send a specially crafted RDP request to the vulnerable FreeRDP instance. While the CVSS score is LOW, a denial-of-service can disrupt remote access and potentially impact critical services relying on RDP connectivity. The impact is particularly relevant in environments where RDP is used for remote administration or access to sensitive data.

Systems utilizing FreeRDP for remote access, particularly those running older versions (≤ 3.24.0), are at risk. This includes organizations relying on FreeRDP for thin client deployments, remote administration of servers, or providing remote desktop services to employees. Shared hosting environments where FreeRDP is deployed could also be affected.

• linux / server:

journalctl -f -u freerdp_server | grep -i 'error'  # Monitor FreeRDP server logs for errors
ps aux | grep freerdp # Check running FreeRDP processes

1. 2026-03-13Disclosure

   disclosure

1. Reserviert2026-03-04
2. Veröffentlicht2026-03-13
3. Geändert2026-03-16
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-29776 is to upgrade FreeRDP to version 3.24.0 or later. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting network access to the FreeRDP server, limiting RDP connections, and employing a Web Application Firewall (WAF) to filter malicious RDP traffic. Monitoring RDP logs for unusual activity or connection attempts can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting to connect with a known malicious RDP payload (if available) and confirming that the server remains stable.