Integer Overflow in FreeRDP Remote Desktop Implementation

CVE-2026-57156

What is CVE-2026-57156?

FreeRDP, a free implementation of the Remote Desktop Protocol, contains an integer overflow vulnerability in its client applications prior to version 3.28.0. This issue arises in the 'update_read_delta_points' function within the core library, where an attacker can exploit a point count controlled by them. As a result, this leads to the allocation of an insufficiently sized heap buffer, ultimately allowing for memory corruption during the initialization process. Users are advised to update to version 3.28.0 to resolve this issue and enhance security.

References