CVE-2026-67290

HIGH 7.5

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.

CWE	CWE-125
Vendor	freerdp
Product	freerdp
Published	Aug 1, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new high vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FreeRDP / FreeRDP

0 < 3.29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whq8-c3v3-p8v8 github.com: https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3 vulncheck.com: https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-tsmf

Credits

🔍 1121984919