CVE-2026-57156: FreeRDP Buffer Overflow Vulnerability

CVE-2026-57156 Overview

CVE-2026-57156 is a heap-based buffer overflow in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in update_read_delta_points within libfreerdp/core/orders.c and affects 32-bit builds of FreeRDP prior to version 3.28.0. An integer overflow occurs when an attacker-controlled point count is multiplied by sizeof(DELTA_POINT), causing FreeRDP clients to allocate an undersized heap buffer. A malicious RDP peer can then write past the buffer boundary during initialization. The issue is tracked as [CWE-122] Heap-based Buffer Overflow and is fixed in FreeRDP 3.28.0.

Critical Impact

A malicious RDP server can trigger a heap buffer overflow in a connecting FreeRDP client on 32-bit builds, enabling memory corruption and potential code execution against the client.

Affected Products

• FreeRDP versions prior to 3.28.0 (32-bit builds)
• FreeRDP client applications linking libfreerdp/core/orders.c
• Downstream projects and distributions bundling vulnerable FreeRDP releases

Discovery Timeline

• 2026-07-10 - CVE-2026-57156 published to NVD
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-57156

Vulnerability Analysis

The vulnerability lives in the update_read_delta_points order-parsing routine. FreeRDP reads a number value from the wire, then computes the allocation size for a DELTA_POINT array using number * sizeof(DELTA_POINT). On 32-bit builds, a large number value causes this multiplication to wrap around SIZE_MAX, producing a small allocation.

After the undersized buffer is allocated, FreeRDP writes numberDELTA_POINT entries during initialization. The write count is derived from the original untruncated number, so the loop iterates far beyond the buffer's true capacity. The result is a linear heap out-of-bounds write controlled by the RDP peer.

Because the parser executes before any post-authentication trust boundary is fully established, an attacker who lures a victim to connect to a hostile RDP server can reach the vulnerable code path.

Root Cause

The pre-patch check used the wrong direction of comparison against SIZE_MAX. The condition SIZE_MAX / number > sizeof(DELTA_POINT) returned early only when overflow could NOT occur, letting overflowing inputs proceed. The fix inverts the comparison so the function returns FALSE when the multiplication would overflow.

Attack Vector

Exploitation requires a victim to initiate an RDP session to an attacker-controlled server or be redirected through a man-in-the-middle. No prior authentication is required, but user interaction is needed to launch the connection. The malicious server sends crafted drawing orders containing an oversized number field to trigger the heap corruption on the client.

	BYTE flags = 0;
	UINT32 zeroBitsSize = ((number + 3) / 4);

-	if (SIZE_MAX / number > sizeof(DELTA_POINT))
+	if (SIZE_MAX / number <= sizeof(DELTA_POINT))
		return FALSE;

	WINPR_ASSERT(points);

Source: FreeRDP commit 487f35da. The patch corrects the overflow-guard predicate so the function bails out when number * sizeof(DELTA_POINT) would overflow SIZE_MAX.

Detection Methods for CVE-2026-57156

Indicators of Compromise

• Unexpected FreeRDP client crashes, SIGSEGV, or heap corruption aborts shortly after connecting to an RDP host.
• Outbound RDP (TCP/3389) sessions from user endpoints to unknown or untrusted remote hosts.
• Presence of FreeRDP binaries with reported versions below 3.28.0, particularly i386/i686 builds.

Detection Strategies

• Inventory installed FreeRDP packages across Linux, macOS, and Windows endpoints and flag builds prior to 3.28.0.
• Monitor process telemetry for FreeRDP client processes (xfreerdp, wlfreerdp) terminating abnormally after RDP session establishment.
• Inspect RDP session metadata for connections to non-corporate destinations initiated by developer or admin workstations.

Monitoring Recommendations

• Alert on crash dumps or ASAN/heap-corruption signatures associated with FreeRDP processes.
• Track outbound TCP/3389 flows from endpoints that do not normally initiate RDP sessions.
• Correlate FreeRDP version telemetry with software inventory to identify unpatched 32-bit builds.

How to Mitigate CVE-2026-57156

Immediate Actions Required

• Upgrade FreeRDP to version 3.28.0 or later on all clients and dependent applications.
• Prioritize patching of 32-bit builds, which are directly exploitable by this integer overflow.
• Restrict outbound RDP connections from workstations to a vetted allow-list of internal RDP hosts.

Patch Information

The fix is included in FreeRDP 3.28.0 via pull request #12938 and commit 487f35da. Details are documented in the FreeRDP GHSA-v5wf-j8j4-77h7 advisory and the 3.28.0 release notes.

Workarounds

• Where upgrading is not immediately possible, deploy 64-bit FreeRDP builds, which are not affected by this specific overflow.
• Block outbound TCP/3389 to untrusted networks via host or perimeter firewall rules.
• Instruct users to connect only to known internal RDP hosts until patched clients are deployed.

# Verify installed FreeRDP client version
xfreerdp --version

# Debian/Ubuntu example - upgrade FreeRDP packages
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 libfreerdp2-2

# Block outbound RDP from a Linux workstation as a temporary mitigation
sudo iptables -A OUTPUT -p tcp --dport 3389 -j REJECT