CVE-2026-29776: freerdp Integer Overflow or Wraparound
CVSS: 3.1v3.1LowAnalyzed
AliasesUBUNTU-CVE-2026-29776DEBIAN-CVE-2026-29776
Published 13-03-2026Last modified 16-03-2026
Vulnerability summary
CVE-2026-29776 is a low (CVSS 3.1) Integer Overflow or Wraparound vulnerability in freerdp. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.6% of scored vulnerabilities.
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)EPSS score
0.29%
0%100%
Low · +0.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 13-03-2026PublishedVulnerability first disclosed.
- 16-03-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
CVSS metrics
4 scores · 4 sources · 1 versionLow 3.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:LSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
+0.12 pp
From 0.18% on 20-09-2026
20-09-202620-10-2026
EPSS score0.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected systems
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.30.0+dfsg-0ubuntu0.24.04.1 | All versions (No fix recorded)
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3< 3.15.0+dfsg-2.1+deb13u2 | < 3.24.0+dfsg-1
Freerdp1 product
- freerdp< 3.24.0
3 vendors · 6 products
References
6 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c747-x4wf-cqrrX Refsource CONFIRMREPORTPatchVendor Advisory
- github.com/FreeRDP/FreeRDP/commit/a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8aX Refsource MISCREPORTPatch
