High [CVE-2026-57156] Arbitrary code execution or denial of service via integer overflow in RDP message processing

FreeRDP is a free implementation of the Remote Desktop Protocol.

Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization.

This issue is fixed in version 3.28.0. A remote attacker, acting as a malicious Remote Desktop Protocol (RDP) peer, could exploit an integer overflow vulnerability.

This overflow occurs when the client processes a specially crafted RDP message, leading to the allocation of an undersized memory buffer. Consequently, the client attempts to write data beyond the boundaries of this buffer, which can result in arbitrary code execution or a denial of service.

Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787.

Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.

Red Hat does not currently list a fixing RHSA for this CVE.

Affected products named by the advisory: Red Hat package: freerdp.