CVE catalog

CVE-2026-31806

FreeRDP vulnerabilities

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Mar 12, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.67% · Oct 25, 2026

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	freerdp2	bookworm	`2.11.7+dfsg1-6~deb12u1`	vulnerable
Ubuntu	freerdp2	noble	Not reported	vulnerable
Ubuntu	freerdp3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp3-dev	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp3-shadow-x11	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp3-wayland	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp3-x11	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libfreerdp-client3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libfreerdp-server3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libfreerdp-shadow-subsystem3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libfreerdp-shadow3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libfreerdp3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libwinpr-tools3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libwinpr3-3	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	libwinpr3-dev	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	winpr3-utils	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4`	vulnerable
Ubuntu	freerdp2	pro	`2.10.0+dfsg1-1.1ubuntu1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1build1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1build3`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1build1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1build2`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm2`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm3`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm4`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm5`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm6`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2build1`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.5.0+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.0+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.2`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.3`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.4`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.5`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.6`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.7`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.8`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.9`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.10`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.11`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu2`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu3`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu4`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.0+dfsg1-0ubuntu1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.2`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.4`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.5`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.6`	vulnerable
Ubuntu	freerdp3	24.04	`3.30.0+dfsg-0ubuntu0.24.04.1`	fixed
Ubuntu	freerdp3	25.10	`3.14.0+dfsg-1ubuntu1`	vulnerable
Ubuntu	freerdp3	25.10	`3.15.0+dfsg-2.1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-1ubuntu1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.3`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.4`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.5`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	freerdp2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Ubuntu	freerdp3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	freerdp3-dev	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	freerdp3-shadow-x11	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	freerdp3-wayland	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	freerdp3-x11	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libfreerdp-client3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libfreerdp-server3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libfreerdp-shadow-subsystem3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libfreerdp-shadow3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libfreerdp3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libwinpr-tools3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libwinpr3-3	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libwinpr3-dev	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	winpr3-utils	deb	noble	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	freerdp3	deb	24.04	`3.30.0+dfsg-0ubuntu0.24.04.1`	Not reported	UBUNTU-CVE-2026-31806	Not reported

Notes

[bookworm] freerdp2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[freerdp2-dev]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[freerdp2-shadow-x11]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[freerdp2-wayland]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[freerdp2-x11]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libfreerdp2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libfreerdp-client2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libfreerdp-server2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libfreerdp-shadow2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libfreerdp-shadow-subsystem2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libuwac0-0]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libuwac0-dev]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libwinpr2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libwinpr2-dev]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[libwinpr-tools2-2]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
[winpr-utils]Affected
Source package: [freerdp2]
Details (2)
- 2.11.7+dfsg1-6~deb12u1 · amd64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12
- 2.11.7+dfsg1-6~deb12u1 · arm64 · bookworm
  Affected
  usn · freerdp2 · debian · bookworm; usn · freerdp2 · debian · 12

[Debian 13 (Trixie)]

[freerdp3-dev]Fixed
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
[freerdp3-proxy]Fixed
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
[freerdp3-proxy-modules]Fixed
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
[freerdp3-sdl]Fixed
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
[freerdp3-shadow-x11]Fixed
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 3.15.0+dfsg-2.1+deb13u2
  usn · freerdp3 · debian · 13

Next results

Observed: Oct 24, 2026, 12:37:10 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]