CVE-2026-57156
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In 32-bit builds of FreeRDP prior to 3.28.0, an integer overflow occurs in the update_read_delta_points function in libfreerdp/core/orders.c. A malicious RDP server can exploit this to allocate an undersized heap buffer and write beyond its bounds.
Risk Assessment
The organization is at risk of remote code execution or RDP client crash, potentially leading to workstation compromise or data leakage.
Recommendation
Immediately upgrade FreeRDP to version 3.28.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.