CVE-2026-57156 Details
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.
A heap-based buffer overflow vulnerability has been identified in FreeRDP clients on 32-bit builds, prior to version 3.28.0. The issue arises in the Orders Delta Points handling within the core library, where an integer overflow occurs when multiplying a network-controlled point count by the size of a DELTA_POINT. This flaw allows a malicious RDP peer to manipulate the point count, leading to the allocation of an insufficiently sized heap buffer. During initialization, this buffer overflow can be exploited, causing memory corruption.
Users can upgrade to FreeRDP version 3.28.0 or later, where this vulnerability has been fixed. The updated version can be downloaded from the FreeRDP releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/487f35daccb36a6224e530dcd8fa60850825f823 | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/pull/12938 | [email protected] | Issue TrackingPatch |
| https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 | [email protected] | Release Notes |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.28.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |